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^\ ' Abstract. Shor has showed how to perform fault tolerant quantum computation when the probability for an error in a 

qubit or a gate, rj, decays with the size of the computation polylogarithmically, an assumption which is physically unreasonable. 
f*^ ' This paper improves this result and shows that quantum computation can be made robust against errors and inaccuracies, 

^2 1 when the error rate, rj, is smaller than a constant threshold, rjc- The cost is polylogarithmic in space and time. The result 

holds for a very general noise model, which includes probabilistic errors, decoherence, amplitude damping, depolarization, and 
^«^ 1 systematic inaccuracies in the gates. Moreover, we allow exponentially decaying correlations between the errors both in space 

and in time. Fault tolerant computation can be performed with any universal set of gates. The result also holds for quantum 
particles with p > 2 states, namely qupits, and is also generalized to one dimensional quantum computers with only nearest 
^ neighbor interactions. No measurements, or classical operations, are required during the quantum computation. 

We use Calderbank-Shor Steane (CSS) quantum error correcting codes, generalized to qupits, and introduce a new class 

of CSS codes over Fp, called polynomial codes. It is shown how to apply a universal set of gates fault tolerantly on states 

VO ' encoded by general CSS codes, based on modifications of Shor's procedures, and on states encoded by polynomial codes, where 

^ ^ ■ the procedures for polynomial codes have a simple and systematic structure based on the algebraic properties of the code. 

Geometrical and group theoretical arguments are used to prove the universality of the two sets of gates. Our key theorem 

asserts that applying computation on encoded states recursively achieves fault tolerance against constant error rate. The 

generalization to general noise models is done using the framework of quantum circuits with density matrices. Finally, we 

calculate the threshold to be rjc — 10^'', in the best case. 

^H ■ The paper contains new and significantly simpler proofs for most of the known results which we use. For example, we give a 

C^ ' simple proof that it suffices to correct bit and phase flips, we significantly simplify Calderbank and Shor's original proof of the 

^ I correctness of CSS codes. We also give a simple proof of the fact that two-qubit gates are universal. The paper thus provides 

a self contained and complete proof for universal fault tolerant quantum computation. 
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^\ ' 1. Outline. Quantum computation has recently gained a lot of attention, due to oracle results |65|, 

C^ ' Eg, UW and quantum algorithms [E5l psl Bq], in particular Shor's factorization algorithm p^. These results 

indicate a possibility that quantum computers are exponentially more powerful than classical computers. It is 
yet unclear whether and how quantum computers will be physically realizable M, E3, RO, p^, ROl BU p3, p9, M 
but as any physical system, they in principle will be subjected to noise, such as decoherence [[Zq , [7l| , and 
inaccuracies. Thus, the question of correcting noise cannot be separated from the complexity questions. 
Without error corrections, the effect of noise will accumulate and ruin the entire computation [£2| |l^ g^ ^ [j , 
and hence the computation must be protected. For classical circuits, von Neumann has shown already in 1956 



*A preliminary version of this paper, under the name "Fault- Tolerant Quantum Computation With Constant Error", was 
published in Proceedings of the 29th Annual ACM Symposium on Theory of Computing (STOC) 1997 
t School of Mathematics, Institute for Advanced Studies, Princeton, New Jersey 
f Department of Computer Science, The Hebrew University, Jerusalem, Israel 



that the computation can be made robust to noise [p3[ . However, the similar question for quantum systems 
is much more comphcated. Even the simpler question of protecting quantum information is harder than the 
classical analogue because one must also protect the quantum correlations between the quantum bits (qubits). 
It was argued by scientists that due to the continuity of quantum states, and to the fact that quantum states 
cannot be cloned |7J, it will be impossible to protect quantum information from noise [Q ^. Despite these 
pessimistic beliefs, Shor discovered a scheme to reduce the effect of decoherence |6j . Immediately after 
that, Calderbank and Shor||l3| and Steanep3 showed that good quantum error correcting codes exist, a 
result which was followed by many explicit examples of quantum codes (e.g.[|46|, pSf). A theory for quantum 
error correcting codes was developed [Q, and a group theoretical framework for almost all codes was found 
[|l4| , [l5| , pl|| . The existence of quantum error correcting codes, however, does not imply the existence of 
noise resistant quantum computation, since due to computation the faults propagate. One must be able to 
compute without allowing the errors to propagate too much, while error corrections should be made in the 
presence of noise. Recently Shor|Q| showed how to use quantum codes in order to perform fault tolerant 
quantum computation in the presence of probabilistic errors, when the error rate, or the fault probability 
each time step, per qubit or gate, is polylogarithmically small. This assumption is physically unrealistic. 
In this paper we improve this result and show how to perform fault tolerant quantum computation in the 
presence of constant error rate, as long as the error rate 77, is smaller than some constant threshold, 770- The 
result holds for a very general noise model, which includes, besides probabilistic errors, also decoherence, 
amplitude and phase damping, depolarization, and systematic inaccuracies in the gates. Fault tolerance can 
be achieved using any universal set of gates. The result also holds when working with quantum particles 
of more than two states, instead of qubits. Our scheme can be generalized to work also in the case in 
which the quantum computer is a one dimensional array of qubits or qupits, with only nearest neighbor 
interactions. No measurements, or classical operations, are required during the quantum computation. The 
cost is poly logarithmic in the depth and size of the quantum circuit. The main assumption on the noise is 
that of locality, i.e. the noise process in different gates and qubits is independent in time and space. This 
assumption can be slightly relaxed, by allowing exponentially decaying correlations in both space and time. 
Such assumptions are made also in the classical scenario, and are likely to hold in physical realizations of 
quantum computers. Thus, this paper settles the question of quantum computation in the presence of local 
noise. 

Let us first describe the computational model with which we work. The standard model||2^, ^, [7^ of 
quantum circuits with unitary gates, allows only unitary operations on qubits. However, noisy quantum 
systems are not isolated from other quantum systems, usually referred to as the environment. Their inter- 
actions with the environment arc unitary, but when restricting the system to the quantum computer alone 
the operation on the system is no longer unitary, and the state of the quantum circuit is no longer a vector 
in the Hilbert space. It is possible to stay in the unitary model, keeping track of the state of the environ- 
ment. However, this environment is not part of the computer, and it is assumed that we have no control 
or information on its state. We find it more elegant to follow the framework of the physicists, and to work 
within the model of quantum circuits with mixed states defined by Aharonov, Kitaev and NisanQ. In this 
model, the state of the set of qubits is always defined: It is a probability distribution over pure states, i.e. a 



mixed state, or a density matrix, and not merely a pure state as in the standard model. The quantum gates 
in this model are not necessarily unitary: any physically allowed operator on qubits is a quantum gate. In 
general, it is easiest to think of a general physical operator as a unitary operation on the system of qubits 
and any number of extra qubits, followed by an operator which discards the extra qubits. In particular, one 
can describe in this model an operation which adds a blank qubit to the system, or discards a qubit. The 
model of quantum circuits with mixed states is equivalent in computational power to the standard model of 
quantum circuits M, but is more appropriate to work with when dealing with errors. 

The noise process can be described naturally in this model as follows. Since noise is a dynamical process 
which depends on time, the circuit will be leveled, i.e. gates will be applied at discrete time steps. Between 
the time steps, we add the noise process. The simplest model for noise is the probabilistic process: Each 
time step, each qubit or gate undergoes a fault (i.e. an arbitrary quantum operation) with independent 
probability 77, and 77 is referred to as the error rate. The probabilistic noise process can be generalized to 
a more realistic model of noise, which is the following: Each qubit or (qubits participating in the same 
gate), each time step, undergoes a physical operator which is at most 77 far from the identity, in some metric 
on operators. This model includes, apart from probabilistic errors, also decoherence, amplitude and phase 
damping and systematic inaccuracies in the gates. Two important assumptions were made in this definition: 
Independence between different faults in space, i.e. locality, and independence in time, which is called the 
Markovian assumption. It turns out that for our purposes, we can release these two restrictions slightly, to 
allow exponentially decaying correlations in both time and space, and all the results of this paper will still 
hold. However, we will turn to the generalized noise model in a very late stage of this paper. Meanwhile, it 
is simpler to keep in mind the independent probabilistic noise model. 

Before we explain how to make quantum circuits fault tolerant, let us discuss how to protect quantum 
information against noise using quantum error correcting codes. As in classical linear block codes, a quantum 
error correcting code encodes the state of each qubit on a block of, say, m qubits. The encoded state is 
sometimes called the logical state. The code is said to correct d errors if the logical state is recoverable given 
that not more than d errors occurred in each block. The difference from classical codes is that quantum 
superpositions should be recoverable as well, so one should be able to protect quantum coherence, and not 
only basis states. Calderbank and Shor]!^ and Steane JG^l were the first to construct such quantum codes, 
which are now called CSS codes. The basic ingredients are two observations. First, the most general fault, 
or quantum operation, on a qubit can be described as a linear combination of four simple operations: The 
identity, i.e. no error at all, a bit flip (|0) ^^ |1)), a phase flip (|0) 1 — > |0), |1) 1 — > ^ |1)) or both a bit flip 
and a phase flip. We give here a simple proof of the fact, first proven by Bennett at. a/.Q, that it suffices 
to correct only these four basic errors. In order to correct bit flips, one can use analogues of classical error 
correcting codes. To correct phase flips, another observation comes in handy: A phase flip is actually a 
bit flip in the Fourier transformed basis, and hence, one can correct bit flips in the original basis, and then 
correct bit flips in the Fourier transformed basis, which translates to correcting phase flips in the original 
basis. In this paper we give an alternative proof for CSS codes, which generalized these ideas to quantum 
particles with p > 2 states, and is signiflcantly simpler than the original proof of Calderbank and Shor[[l3|. 

We define a new class of quantum codes, which are called polynomial codes. The idea is based on a 



theorem by Schumacher and Nielsen|61 which asserts that a quantum state can be corrected only if no 
information about the state has leaked to the environment through the noise process. More precisely, if the 
reduced density matrix on any t qubits does not depend on the logical qubit, then there exists a unitary 
operation which recovers the original state even if the environment interacted with t qubits, i.e. t errors 
occurred. This is reminiscent of the situation in classical secret sharing schemes: We should divide the 
"secret" , i.e. the logical qubit, among many parties (i.e. physical qupits) such that no t parties share any 
information about the secret. This analogy between secret sharing and quantum codes suggests that secret 
sharing schemes might prove useful in quantum coding theory. Here, we adopt the scheme suggested by 
Ben-Or, Goldwasser and WigdersonB], who suggested to use random polynomials, evaluated at different 
points in a field of p elements, as a way to divide a secret among a few parties. A random polynomial of 
degree d is chosen, and then each party gets the evaluation of the polynomial at a different point in the field 
Fp. The secret is the value of the polynomial at 0. To adopt this scheme to the quantum setting, we simply 
replace the random polynomial by a superposition of all polynomials, to get a quantum code. It turns out 
that we get a special case of the CSS codes. Polynomial codes are useful from many aspects. First, they 
have a very nice algebraic structure, which allows to manipulate them easily. This allows us to apply fault 
tolerant operations on states encoded by polynomial codes in a simple and systematic way, as we will see 
later. Polynomial codes might also have nice applications to other areas in quantum information theory, as 
was demonstrated recently by Gottesman et a/[p5[ who used polynomial codes for quantum secret sharing. 
We will use both polynomial codes and general CSS codes in our fault tolerant scheme. 

In order to protect a quantum computation against faults, one can try to compute not on the states 
themselves, but on states encoded by quantum error correcting codes. Each gate in the original computation 
will be replaced by a "procedure", which applies the encoded gate on the encoded state. Naturally, in 
order to prevent accumulation of errors, error corrections should be applied frequently. Unfortunately, 
computing on encoded quantum states does not automatically provide protection against faults, even if error 
corrections are applied after every procedure. The problem lies in the fact that during the computation of 
the procedure, faults can propagate to "correct" qubits. This can happen if a gate operates on a damaged 
qubit and some "correct" qubits- in general, this can cause all the qubits that participate in the gate to be 
damaged. The procedures should thus be designed carefully, in such a way that a fault during the operation 
of the procedure can only effect a small number of qubits in each block. We refer to such procedures as fault 
tolerant procedures. It turns out that many gates can be applied bitwise, meaning that applying the gate 
on each qubit separately, achieves the desired gate on the encoded state. Unfortunately, not all gates can be 
applied fault tolerantly in such a simple way, and sometimes a very complicated procedure is needed. We 
are actually looking for a pair consisting of a quantum code which can correct d errors, and a corresponding 
universal set of gates, such that their procedures, with respect to the code, allow one fault to spread to at 
most d qubits. Since the error corrections, encoding, and decoding procedures are also subjected to faults, 
we need them to be fault tolerant too. 

In |64|, Shor introduced a universal set of gates, which we denote by Qi, and showed how to apply the 
gates fault tolerantly on encoded states. It turns out that almost all of the gates in Qi can be applied bitwise. 
The complicated procedures are the fault tolerant error correction and encoding, and the Toffoli gate. Shor 



used noiseless measurements and classical computation extensively in these procedures. Here, we modify 
Shor's procedures so that they can be performed within the framework of our model, i.e. all operations 
are quantum operations, subjected to noise. Basically, we follow Shor's constructions, with some additional 
tricks. We remark here that in this paper we make an effort to show that fault tolerance can be achieved 
without using classical operations or measurements. This fact is desirable because of two reasons. One is 
purely theoretical: One would like to know that measurements and classical operations are not essential, 
and that the quantum model is complete in the sense that it can be made fault tolerant within itself. The 
other reason is practical: In some suggestions for physical realizations of quantum computers, such as the 
NMR computer, it might be very hard to incorporate measurements and classical computations during the 
quantum computation. Thus, we require that all procedures are done using only quantum computation. 

For polynomial codes, we introduce a new universal set of gates which we denote by Q2, and show how to 
perform these gates fault tolerantly on states encoded with polynomial codes. Here is where the advantage 
of polynomial codes come into play. Unlike the construction of the fault tolerant Toffoli gate for CSS codes, 
(and other fault tolerant constructions) which is a long and complicated sequence of tricks, the fault tolerant 
procedures for polynomial codes all have a common relatively simple structure, which uses the algebraic 
properties of the polynomials. To perform a gates in Q2, we apply two steps. First the gate is applied 
pit-wise. This always achieves the correct operation of the gate, but sometimes the final state is encoded 
by polynomial codes with degree which is twice the original degree d. The second step is therefore a degree 
reduction, which can be applied using interpolation techniques, as the quantum analogue of the degree 
reductions used in Q. Thus, the fault tolerant procedures for polynomial codes have a simple systematic 
structure. 

Next, we prove the universality of the two sets of gates which we use, Gi for the CSS codes and G2 for 
the polynomial codes. Universality of a set of gates means that the subgroup generated by the set of gates 
is dense in the group of unitary operations on n qubits, f/(2"), (for qupits the group is U{p'^)). Kitaev|39|| 
and Solovay |6q] showed, by a beautiful proof which uses Lie algebra and Lie groups, that universality of a 
set Q guarantees that any quantum computation can be approximated by a circuit which uses Q with only 
polylogarithmic cost. Our proof of universality of Qi is a simple reduction to a set of gates, which was shown 
to be universal by Kitaev|39]. The proof that Q2 is universal is more involved. The idea is first to generate, 
using gates from Q2, matrices with eigenvalues which are not integer roots of unity, a fact which is proved 
using field theoretical arguments. This enables us to show that certain C/(2) subgroups are contained in the 
subgroup generated by Q2, where these U{2) operate on non orthogonal subspaces, which together span the 
entire space. To complete the proof, we prove a geometrical lemma which asserts that if A and B are non 
orthogonal then U{A) U U{B) generate the whole group U{A ® B). Thus we have that both sets of gates 
which are used in our scheme are universal. 

We proceed to explain how a quantum code accompanied with fault tolerant procedures for a universal 
set of gates can be used to enhance the reliability of a quantum circuit. We start with our original quantum 
circuit, Afo. The circuit Mi which will compute on encoded states is defined as a simulation of A/q- A qubit 
in Mq transforms to a block of m qubits in Mi , and each gate in Mq transforms to a fault tolerant procedure 
in Ml applied on the corresponding blocks. Note that procedures might take more than one time step to 



perform. Thus, a time step in Mq is mapped to a time interval in Mi, which is called a working period. In 
order to prevent accumulation of errors, at the end of each working period an error correction is applied on 
each block. The working period now consists of two stages: a computation stage and a correction stage. 
The idea is therefore to apply alternately computation stages and correction stages, hoping that during the 
computation stage the damage that accumulated is still small enough so that the corrections are still able 
to correct it. 

We now want to show that the reliability of the simulating circuit is larger than that of the original circuit. 
In the original circuit, the occurrence of one fault may cause the failure of the computation. In contrast, 
the simulating circuit can tolerate a number of errors, say fc, in each procedure, since they are immediately 
corrected in the following error correcting stage. The effective noise rate of Mi is thus the probability for 
more than k faults in a procedure. This effective error rate will be smaller than the actual error rate 77, if 77 
is smaller than a certain threshold, rjc, which depends on the size of the procedures, and on the number of 
errors which the error correcting code can correct. If ry < rjc, Mi will be more reliable than Mq. For fault 
tolerance, we need the effective error rate to be polynomially small, to ensure that with constant probability 
no effective error occurred. In |Q Shor uses quantum CSS codes which encode one qubit on polylog(n) to 
achieve fault tolerance with the error rate rj being polylogarithmically small. 

The main goal of this paper is to improve this result and to show that quantum computation can be 
robust even in the presence of constant error rate. Such an improvement from a constant error rate rj to 
polynomially small effective noise rate is impossible to achieve in the above method. Instead, reliability 
in the presence of constant error rate is achieved by applying the above scheme recursively. The idea is 
simple: as long as the error rate is below the threshold, the effective noise rate of the simulating circuit can 
be decreased by simulating it again, and so on for several levels, say r, to get the final circuit Mr- It will 
suffice that each level of simulation improves only slightly the effective noise rate, since the improvement 
is exponential in the number of levels. Such a small improvement can be achieved when using a code of 
constant block size. 

The final circuit, M^, has an hierarchical structure. Each qubit in the original circuit transforms to a 
block of qubits in the next level, and they in their turn transform to a block of blocks in the second simulation 
and so on. A gate in the original circuit transforms to a procedure in the next level, which transforms to 
a larger procedure containing smaller procedures in the next level and so on. The final circuit computes 
in all the levels: The largest procedures, computing on the largest (highest level) blocks, correspond to 
operations on qubits in the original circuit. The smaller procedures, operating on smaller blocks, correspond 
to computation in lower levels. Note, that each level simulates the error corrections in the previous level, 
and adds error corrections in the current level. The final circuit, thus, includes error corrections of all the 
levels, where during the computation of error corrections of larger blocks smaller blocks of lower levels are 
being corrected. The lower the level, the more often error corrections of this level are applied, which is in 
correspondence with the fact that smaller blocks are more likely to be quickly damaged. 

The analysis of the scheme turns out to be quite complicated. To do this, we generalizes the works of 
Tsirelson [Q and Gac's [g8| to the quantum case. First, we distinguish between two notions: The error in 
the state of the qubits, i.e. the set of qubits which have errors, and the actual faults which took place during 
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the computation, namely the fauh path, which is a list of points in time and place where faults had occurred 
(in a specific run of the computation.) We then define the notion of sparse errors and sparse fault paths. 
Naturally, due to the hierarchical structure of this scheme, these notions are defined recursively. A block in 
the lowest level is said to be close to it's correct state if it does not have too many errors, and a higher level 
block is "close" to it's correct state if it does not contain too many blocks of the previous level which are 
far from their correct state. If all the blocks of the highest level are close to being correct, we say that the 
set of errors is sparse. Which set of faults does not cause the state to be too far from correct in the above 
metric? The answer is recursive too: A computation of the lowest level procedure is said to be undamaged 
if not too many faults occurred in it. Computation of higher level procedures are not damaged if they do 
not contain too many lower level procedures which are damaged. A fault path will be called sparse, if the 
computations of all the highest level procedures are not damaged. The proof of the threshold result is done 
by showing that the probability for "bad" faults, i.e. the probability for the set of faults not to be sparse 
decays exponentially with the number of levels, r. Thus, bad faults are negligible, if the error rate is below 
the threshold. This is the easy part. The more complicated task is to show that the "good" faults are indeed 
good: i.e. if the set of faults is sparse enough, then the set of errors is also kept sparse until the end of the 
computation. This part is done using induction on the number of levels r, and is quite involved. 

So far, we have dealt only with probabilistic faults. Actually, the circuit generated by the above recursive 
scheme is robust also against general local noise. We prove this by writing the noise operator on each qubit 
as the identity plus a small error term. Expanding the error terms in powers of rj, we get a sum of terms, each 
corresponding to a different fault path. The threshold result for general noise is again proved by dividing 
the faults to good and bad parts. First, we show that the bad part is negligible i.e. the norm of the sum 
of all terms which correspond to non-sparse fault paths is small. The proof that the good faults are indeed 
good, i.e. that the error in the terms corresponding to sparse fault paths is sparse, is based on the proof for 
probabilistic errors, together with some linearity considerations. 

So far, what we have shown is that fault tolerant computation can be achieved using one of the two sets 
of gates, Qi,Q2- In fact, fault tolerant computation can be performed using any universal set of gates. This 
last generalization is shown by first designing a circuit which uses gates from Qi or Q2, and then approximate 
each gate in the final circuit, up to constant accuracy, by a constant number of gates from the desired set of 
gates which we want to work with. This completes the proof of the threshold result in full generality. 

The threshold result is shown to hold also for one dimensional quantum circuits. These are systems of n 
qubits arranged in a line, where gates are applied only on nearest neighbor qubits, and all qubits are present 
from the beginning. In this model, one cannot insert a new qubit between two existing qubits, in order to 
preserve the geometry of the arrangements. However, the non unitary operation which initializes a qubit 
in the middle of the computation is allowed. To apply fault tolerant procedures in this case, we use swap 
gates in order to bring far away qubits together. We show that these swap gates do not cause the error to 
propagate too much. 

Finally, it is left to estimate the exact threshold in all the above cases. We give a general simple formula 
to calculate the threshold in the error rate, given the fault tolerant procedures. This formula depends only 
on two parameters of these procedures: the size of the largest procedure used in our scheme, and the number 
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of errors which the code corrects. The size of the procedures depend strongly on many variables, such as 
the geometry of the system, the exact universal set of gates which is used, and whether noiseless classical 
computation can be used during the computation. We give here an estimation of the threshold in one case, 
in which no geometry is imposed on the system, error free classical operations and measurements can be 
performed during the computation, and the codes which are used are polynomial codes. The threshold 
which is achieved in this case is ~ 10~^. We did not attempt to optimize the threshold, and probably many 
improvements can be made which can save a lot of gates in our suggested procedures. 

Some of the assumptions we made in this work cannot be released. First, the choice to work with 
circuits which allow parallelism is necessary, because sequential quantum computation, such as quantum 
Turing machines, cannot be noise resistant g, since error corrections cannot be applied fast enough to 
prevent accumulation of errors. It is also crucial that we allow qubits to be input at different times to the 
circuit unlike (Yao |75| ), because this provides a way to discard entropy which is accumulating in the circuit. 
Without this assumption, i.e. under the restriction that all qubits are initialized at time 0, it is impossible to 
compute fault tolerantly without an exponential blowup in the size of the circuit g. An interesting question 
is whether other assumptions, such as the locality assumption, can be relaxed. A partial positive answer in 
this direction was given by Chuang et. a/.|Q. In connection with the assumptions made for Fault tolerance, 
see also @, 0. 

A substantial part of the results in this paper were published in a proceeding version in B . The threshold 
result was independently described also by Knill, Laflamme and Zurek|Q, and by KitaevQ, ^. This was 
done using different quantum correcting codes, and required measurements in the middle of the quantum 
computation. In this work we provide a complete proof to all the details of the fault tolerant quantum 
computation codes construction and in particular we rigorously show that the recursive scheme works. Kitaev 
has shown another, very elegant way to achieve fault tolerance in a different model of quantum computation, 
which works with anyons pi[ . After the results were first published, it was shown by Gottesman[p2| that fault 
tolerant procedures for the universal set of gates introduced by Shor can be constructed for any stabilizer code, 
using basically the same technique as presented by Shor for the CSS codes, a result which was generalized 
to qupits|33|]. Fault tolerant quantum computation in low dimensions is also discussed by Gottesman[p4|. 
Non binary codes were defined independently also by Chuang[|l8| and Knill[Q. For a survey of this area see 
PreskillH. 

Organization of paper: In section g we define the model of noisy quantum circuits. Section g is 
devoted to CSS and polynomial codes. In section ^ we describe how to apply fault tolerant operations 
on states encoded by CSS codes. In section ^ we describe fault tolerant procedures for polynomial codes. 
Section g proves the universality of the two sets of gates used in the previous two sections. In section M we 
present recursive simulations and the threshold result for probabilistic errors. In section ^we generalize the 
result to general local noise, and in section M we generalize to circuits which use any universal set of gates. 
In section |lO| we explain how to deal with exponentially decaying correlations in the noise. Section yjj proves 



the threshold result for one dimensional quantum circuit, and in 12 we conclude with possible implications 
to physics, and some open questions. 



2. The Model of Noisy Quantum Circuits. In this section we recall the definitions of quantum 
circuits with mixed states as defined by Aharonov, Kitaev and NisanM, and define noisy quantum circuits. 
The model is based on basic quantum physics, and good references are Cohen- Tanudji||2l[, Sakurai |6Cf| , and 
Peres ||. 

2.1. Pure States. A quantum physical system in a pure state is described by a unit vector in a Hilbert 
space, i.e a vector space with an inner product. In the Dirac notation a pure state is denoted by \a). The 
physical system which corresponds to a quantum circuit consists of n quantum two-state particles, and the 
Hilbert space of such a system is 7^2 — C^^'^' i.e. a 2" dimensional complex vector space. 7^2 is viewed as a 
tensor product of n Hilbert spaces of one two-state particle: H2 = 'H2®'H2®- ■ ■®'H2- The fc'th copy of H2 will 
be referred to as the fc'th qubit. We choose a special basis for 7^2 , which is called the computational basis. 
It consists of the 2" orthogonal states: |«), < i < 2", where i is in binary representation. \i) can be seen as 
a tensor product of states in H2: \i) = |ii)|«2)----|«n) — Ni*2--in), where each ij gets or 1. Such a state, \i), 
corresponds to the j'th particle being in the state \ij). A pure state |a) G Tij is generally a superposition of 
the basis states: \a) = X)j=i Ci|*): with X^I^i kiP = 1. A vector in Ti^, Va — (ci, C2, ..., C2'i): written in the 
computational basis representation, with X)i=i kiP — I7 corresponds to the pure state: \a) — X]j=i Ci\i). v\, 
the transposed-complex conjugate of Uq, is denoted {a\. The inner product between \a) and \(3) is denoted 
{a\j3) = (w^,W/3). The matrix v\^vp is denoted as |q;)(/3|. 

2.2. Mixed States. In general, a quantum system is not in a pure state. This may be attributed to 
the fact that we have only partial knowledge about the system, or that the system is not isolated from the 
rest of the universe. We say that the system is in a mixed state, and assign with the system a probability 
distribution, or mixture of pure states, denoted by {a} = {pk, {o-k)}- This means that the system is with 
probability pk in the pure state \ak)- This description is not unique, as different mixtures might represent 
the same physical system. As an alternative description, physicists use the notion of density matrices, 
which is an equivalent description but has many advantages. A density matrix p on Tij is an hermitian (i.e. 
p ~ p^) semi positive definite matrix of dimension 2" x 2" with trace Tr(p) = 1. A pure state \a) = ^^ Ci\i) 
is represented by the density matrix: p\a) = \a){a\, i.e. p\a){i,j) — CiC*. (By definition, p{i,j) — {i\p\j)). 
A mixture {a\ = {pi, |a/)}, is associated with the density matrix pj^j = ^iPi\o''i){cti\- This association is 
not one-to-one, but it is onto the density matrices, because any density matrix describes the mixture of it's 
eigenvectors, with the probabilities being the corresponding eigenvalues. Note that diagonal density matrices 
correspond to probability distributions over classical states. Density matrices are linear operators on their 
Hilbert spaces. 

2.3. Quantum Operators and Quantum Gates. Transformations of density matrices are linear 
operators on operators (sometimes called super- operators). L(A/') denotes the set of all linear operators on A/", 
a finite dimensional Hilbert space. The most general quantum operator is any operator T : L(A/') -^ L(A^) 
which sends density matrices to density matrices. A super-operator is called positive if it sends positive 
semi-definite Hermitian matrices to positive semi-definite Hermitian matrices, so T must be positive. Super- 
operators can be extended to operate on larger spaces by taking tensor product with the identity operator: 
T : L(7V) -^ L(A<) will be extended to T ® I : L{J\f 7^) ^ L{M » TZ), and it is also required that the 
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extended operator remains positive, and such T is called a completely positive map. Clearly, T should also 
be trace-preserving. It turns out that any super operator which satisfies these conditions indeed take density 
matrices to density matrices [^5[ . Thus quantum super-operators are defined as follows: 

Definition 1. A physical super-operator, T, from, k to I qubits is a trace preserving, completely 
positive, linear map from density matrices on k qubits to density matrices on I qubits. 

Linear operations on mixed states preserve the probabilistic interpretation of the mixture, because Top — 
To iJ2iPi\ai){ai\) = '£iPiT°i\ai){ai\)- 

A very important example of a quantum super-operator is the super-operator corresponding to the 
standard unitary transformation on a Hilbert space A/", |a) '—^ U\a), which sends a quantum state p = \a){a\ 
to the state UpU^ . Another important super-operator is discarding a set of qubits. A density matrix of n 
qubits can be reduced to a subset. A, oi m < n qubits. We say that the rest of the system, represented 
by the Hilbert space JF = C^ , is traced out, and denote the new matrix by plyi = Ttjt p, where Trjr : 
'L{Af iS) J-) -^ L(A/') is defined by: p\A{i,j) ~ J2k=i P(*^;J^): ^i^'i ^ runs over a basis for T. In words, it 
means averaging over J-'. If the state of the qubits which arc traced out is in tensor product with the state 
of the other qubits, then discarding the qubits means simply erasing their state. However, if the state of 
the discarded qubits is not in tensor product with the rest, the reduced density matrix is always a mixed 
state. In this paper, a discarding qubit gate will always be applied on qubits which are in tensor product 
with the rest of the system. Any quantum operation which does not operate on JF commutes with this 
tracing out. One more useful quantum super-operator is the one which adds a blank qubit to the system, 
K) : 10 '-^ 10 ^ |0) : C^" -^ C^" . This is described by the super-operator T : pi-^ pC 



A lemma by Choi 1 16 , and Hellwig and Kraus|^ asserts that any physically allowed super-operator from 
k to I qubits can be described as a combination of the above three operations: add k + 1 blank qubits, apply 
a unitary transformation on the 2k + I qubits and then trace out 2k qubits. One can think of this as the 
definition of a quantum super-operator. We define a quantum gate to be the most general quantum operator. 

Definition 2. A quantum gate of order {k,l) is a super- operator from k to I qubits. 

In this paper we will only use three types of quantum gates: discard or add qubits, and of course unitary 
gates. However, quantum noise will be allowed to be a general physical operator. 

2.4. Measurements. A quantum system can be measured, or observed. Let us consider a set of 
positive semi-definite Hermitian operators {Pm}, such that X^m ^™ ~ ^- '^^'^ measurement is a process 
which yields a probabilistic classical output. For a given density matrix p, the output is m with probability 
Pr(77i) = Tr(P,„p). Any measurement thus defines a probability distribution over the possible outputs. In 
this paper we will only need a basic measurement of r qubits. In this case, Pm (with 1 < i < 2'") are 
the projection on the subspace Sm, which is the subspace spanned by basic vectors on which the measured 
qubits have the values corresponding to the string m: Sm ~ span{ \m,j), j — 1, . . . ,2"^*"}. This process 
corresponds to measuring the value of r qubits, in the basic basis, where here, for simplicity, we considered 
measuring the first r qubits. 

To describe a measurement as a super-operator, we replace the classical result of a measurement, m, 
by the density matrix |7n)(r7i| in an appropriate Hilbert space M. The state of the quantum system after 
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a projection measurement is also defined; it is equal to Pr(rn)^^ PmpPm- (It has the same meaning as 
a conditional probability distribution). Thus, the projection measurement can be described by a super- 
operator T which maps quantum states on the space J\f to quantum states on the space M ® M., the result 
being diagonal with respect to the second variable: 



(2.1) 



Tp = ^(P„pP,„)«)(|m)(m 



2.5. The Trace Metric on Density Operators. A useful metric on density matrices, the trace 
metric, was defined in Ej. It is induced from the trace norm for general Hermitian operators. The trace 
norm on Hermitian matrices is the sum of the absolute values of the eigenvalues. ||jo|| = ^^ |Ai| It was shown 
in H that the distance between two matrices in this metric ||/0i — P2II is exactly the measurable distance 
between them: It equals to the maximal total variation distance between all possible outcome distributions 
of the same measurement done on the two matrices. 

2.6. Quantum Circuits with Mixed States. We now define a quantum circuit: 

Definition 3. Let Q be a family of quantum gates. A Quantum circuit that uses gates from Q is 

a directed acyclic graph. Each node v in the graph is labeled by a gate g^ £ Q of order [k^, ly). The in-degree 
and out-degree of v are equal ky and ly, respectively. 
Here is a schematic example of such a circuit. 
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The circuit operates on a density matrix as follows: 

Definition 4. final density matrix; Let Q be a quantum circuit. Choose a topological sort for Q: 
gt...gi. Where gj are the gates used in the circuit. The final density matrix for an initial density matrix p is 
Qo p = gto ...o g2 gio p. 

Q o p is well defined and does not depend on the topological sort of the circuit 0. At the end of the 
computation, the r output qubits are measured, and the classical outcome, which is a string of r bits, is the 
output of the circuit. For an input string i, the probability for an output string j is {j\ I Q o \i){i\ ) \j). 

Definition 5. Computed function: Let Q be a quantum circuit, with n inputs and r outputs. Q is 
said to compute a function f : {0, 1}" 1 — > {0, l}*", with accuracy e if for any input i G {0, 1}", the probability 
for the output to be f(i) is greater than 1 — e. 
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2.7. Quantum Circuits with probabilistic Errors. . To implement noise in the quantmn circuits, 
we divide tiie quantum circuit to time steps, and the gates are apphed at integer time steps. We permit that 
qubits are input and output at different time steps. Fauhs occur in between time steps, in the locations of 
the circuit. 

Definition 6. A set {qi, q2, ..qi, t) is a location in the quantum circuit Q if the qubits (71, ...qi participated 
in the same gate in Q, in time step t. and no other qubit participated in that gate. For this matter, the 
absence of a gate is viewed as the identity gate on one qubit, so if a qubit q did not participate in any gate 
at time t, then {q, t) is a location in Q as well. 

Each location in the circuit exhibits a fault with with independent probability rj. 

Definition 7. The list of times and places where faults had occurred, (in a specific run of the computa- 
tion) is called a fault path. 

Each fault path, J-', is assigned a probability Pr{J-), which is a function of the number of faults in it. A 
fault at time t at a certain location means that an (arbitrary) general quantum operation is applied on the 
faulty qubits after time t. Given a certain fault path, we still have to determine the quantum operations that 
were applied on the faulty qubits. Denote by £{T) the choice of faults for the fault path, say £t, ...82, £i- 
The final density matrix for this given choice £{J-') is easily defined by applying the faults in between the 
gates: Q{T) o p = £f o g^ o ...£2 o g2° £1 ° gi ° P- The final density matrix, Q o p oi the circuit is defined as a 
weighted average over the final density matrices for each fault path: 

(2.2) Qop = J2PriT)Q{T)op. 

This final density matrix depends on the exact choice of quantum operations applied on the faulty gates. 
However, a noisy quantum computer is said to compute a function / with confidence e in the presence of 
error rate rj, if the circuit outputs the function / with accuracy e regardless of the exact specification of the 
quantum operations which occurred during the faults. 

2.8. Quantum Circuits with General Local Noise. In most of the paper we will use only the 
probabilistic noise model described above. However, our result will be generalized in section to a much 
more general noise model. In the general noise model, we replace the probabilistic faults which occur with 
probability rj in each location by applying in each location in the quantum circuit an arbitrary general 
quantum operator, on which the only restriction is that it within 77 distance to the identity, in a certain norm 
of super-operators. Thus, in between time steps, a noise operator operates on all the qubits. For the time 
step t the noise operator is of the form 

(2.3) £{t) = £A,At) ® £A,Jt) ® • • • ® £A,^Jt). 
Ai_t runs over all possible locations at time i, and for each one of them, 

(2.4) \\£AUt)-I\\<rj 

The exact definition of the norm on super-operators is not used in this paper. We merely need the following 
properties: 
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1- l|Tp||<||T||||p|| 

2. \\TR\\ < \\T\\\\R\\ 

3. \\T(g)R\\ = \\T\\\\R\\ 

4. The norm of any physically allowed super-operator T is equal to 1. 

A reasonable norm on super-operators should satisfy these properties. One example is the diamond norm 
suggested by Kitaev[g9[ Q. 

2.9. Connection to Specific Noise Processes. Independent and quasi independent probabilistic 
errors, amplitude and phase damping, decoherence, and systematic inaccuracies in gates, are all special 
cases of the general noise model defined above. For independent probabilistic errors, where an error £ occurs 



with probability 77, we can write for each one of the super-operators in the product 2.3: 

(2.5) £AUt) = il-T^)lA,^^+7^£'AUt) 



where S'ai t(^) is any physical super operator. This satisfies the conditions of local noise 2.3,p]4 with error 



rate 2??. This is true, in particular, also for probabilistic collapses of the wave function, a process in which 
each qubit randomly collapses to one of its basis states, for a given basis (not necessarily the computational 
basis |0),|1)). £'Ait{i) is then the physical super-operator which measures the qubit in the chosen basis. 
Depolarization, in which a qubit is randomly replaced by a completely random qubit, i.e. a qubit in the 
identity density matrix, is also a special case of probabilistic noise, in which the super-operator £' Ai t (t) 
replaces all the qubits in Ai,t by completely random qubits. Decoherence [o|, amplitude damping and phase 
damping[] are all special cases of interactions between the qubits and the environments, and as such they can 
be described in the above models by definition, as long as the process is local. Systematic inaccuracies in a 
given gate are described by applying the same noise operator on all locations where that gate operated. The 
generalizations described in the last subsection describe how to implement quasi independent probabilistic 
errors. 

2.10. Adding correlations to the Noise Model. Two very important assumptions were made when 
introducing our general model of noise. 

• Locality: No correlations between environments of different qubits, except through the gates. 

• The Markovian assumption: The environment is renewed each time step, and hence no correlations 
between the environments at different time steps. 

Both of these assumptions can be slightly released, to allow exponentially decaying correlations in both 
space and time, while the results of this paper still hold. 

To add exponentially decaying correlations to the probabilistic noise model, we generalize it in the 
following way. Instead of considering independent probabilities for error in each location, we require that the 
probability for a fault path which contains k locations is bounded by some constant times the probability 
for the same fault path in the independent errors model: 

(2.6) Pr{fault path with k errors) < cri''{l - 77)""''. 

where v is the number of locations in the circuit. Then, an adversary chooses a noise operator which operates 
on all the qubits in the fault path, without any restrictions. The most general case is as follows. The adversary 
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adds some blank qubits, which are caUed the environment, at the beginning of the computation. Each time 
step, the adversary can operate a general operator on the environment and the set of qubits in the fault 
path at that time step. This model allows correlations in space, since the noise operator need not be of 
the form of a tensor product of operators on different locations. Correlations in time appear because the 
environment that the adversary added in not renewed each time step, so noise operators of different time 
steps are correlated. Note that the independent probabilistic noise process is a special case of this process. 

3. Quantum Error Correcting Codes. Here we recall the definition of quantum codes, and of 
Calderbank-Shor-Steane (CSS) codes[^ Q. These codes were first presented for qubits, that is over the 
field i^2- We give here a proof for the fact that CSS codes are quantum codes, which is significantly simpler 
than the original proof Q, and generalize it to Fp for any p > 2. On our way, we use the fact that it suffices 
to correct phase fiips and bit fiips, in order to correct general errors. This was first proved by Bennett et. 
al. |q| , using a beautiful argument which involved the notion of group symmetry and a quantum operation 
called "twirl" . We give here a simple proof of this theorem, which uses merely linearity of quantum operators, 
and is based on an idea by Steanepq]. 

We then define a new class of quantum codes, which we call polynomial quantum codes. These are a 
special case of CSS codes over Fp. These codes are based on ideas by Ben-Or et. al.M who used random 
polynomials for distributed fault tolerant classical computation. This section assumes basic knowledge in 
classical error correcting codes, which can be found in [ p^ . 

3.1. Quantum Codes. Definition 8. A [k,m\-quantum code is a subspace of dimension k in the 
Hilbert space of m qubits. A word in the code is any vector in the subspace, or more generally any density 
matrix p supported on the subspace. We say that the word had d errors in qubits gi, ..qd if a general physical 
operator on these d qubits, £{qi, ..qd) was applied on p. A procedure 7?,, i.e. a sequence of gates, is said to 
correct an error £(qi, ..qd) on p ii 



(3.1) Tlo£{qi^..qd)o p = p 



Definition 9. Let C be a [fc, to] quantum code. Let {\a.i)^^^i be a basis for this quantum code. C is 
said to correct d errors if there exists a sequence of quantum gates TZ, called an error correction procedure, 
which corrects any d errors on any d qubits, on any word in the code, i.e for any i,j and £{qi, ..qd) 

Tlo£{qi,..qd) o \ai){aj\ = \at){aj\ 

Note that during the operation of TZ, it is allowed to use extra qubits, but at the end all ancillary qubits 
are discarded, and the original state should be recovered. 

3.2. Prom General Errors to Bit Flips and Phase Flips. A crucial and basic fact[g| in quantum 
error corrections is that it suffices to correct two basic errors, called bit flips and phase flips, in a small 
number of qubits, in order to correct a general error on these qubits. Our proof of this fact uses merely 
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linearity of quantum operators. Let us define basic errors as those in which one of the Pauh unitary operators 
occur: 

(3.2) 

ax is called a bit flip, since it takes |0) to |1) and |1) to |0). (t^ is called a phase flip, as it multiplies |1) by 
a minus sign, while leaving |0) as is. ay is a combination of the two, since ay — aza^. A basic error on d 
qubits is obtained by taking tensor products of d of the above Pauli matrices. More formally, consider all 
possible strings e of length d in the alphabet /, x, y, z. The set of 4'' matrices: 

(3.3) CTe = (Te^ «) • --CTei, 6 G {1, X, y , z}'^ 

is a basis for operators on the Hilbert space of d qubits. Before wc show that it suffices to correct basic 
errors, we need two definitions: 

Definition 10. We say that TZ corrects basic errors of length d in C if for any two basis states of the 
code, \a) and |a'), and any basic error of length d, a^ we have 

(3.4) noae\a){a'\al^\a){a'\ 



Definition 11. We say that TZ detects basic errors of length d in C if for any two basis states of the 
code, \a) and \a'), and any two different basic error of length d, ae ^ ae> , 

(3.5) noae\a){a'\al, ^0 

The reason for the fact that such TZ is said to detect errors is that indeed, if at the end of the procedure TZ 
the error e is written down on an ancilla, TZ o ae\a) — \cx) ® |e), then for two different errors the two ancilla 
states are orthogonal, and thus when discarding the ancilla qubits we get zero. In the rest of the paper, we 
will only use error correcting procedures which detect the errors. We can now prove the following: 

Theorem 1. Let C be a quantum code, and let TZ correct and detect any basic error of length d in C. 
Then R corrects any general error on any d qubits in C . 

Proof: We recall that any noise operator C from d to d' qubits can be written as a combination of three 
operators: adding d + d' blank qubits, applying a unitary transformation on the 2d + d' and discarding 2d 
qubits. The last operator which discards qubits will be denoted as T. Combining the first two operations, 
we have in the most general case the following operation on d qubits. For all < i < 2'' — 1, 

(3.6) N)^|0'^+'')l*>^El^')®|j') 

where all the coefficients are put into the vectors {Aj) which arc not unit vectors. We now use the fact that the 
basic errors, CTe, on d qubits form an orthonormal basis with respect to the inner product (V, U) = 2dt'''{VU') 
for 2'' X 2"^ matrices. We define A, a vector of matrices, or a matrix with entries which are vectors, by 
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Aij — \Al). For any basic error vector e of length d, define jAg) = {A, a^) = ^tr{A ■ al), where A should be 
thought of as a vector of matrices, and thus Aal is also a vector of matrices, the trace of which is a vector. 
Due to the fact that the basic errors are orthonormal, we have that ^ ■ \Al) (E) \j) — J^e l^e) ® '^e\i), or 
equivalcntly the two first steps of the noise operator can be written as: 

(3.7) £ = ^|^e>(^e'|^ae-4 

e,e' 

Now, IZ will indeed correct £ — T o C, by the following: 

(3.8) noEo\a){a'\^noroY,\Ae){Ae'\®ae\a){a'\al,^{ToY^\A,){A,\)®\a){a'\ = \a){a'\ 

e.e' e 

where in the second equality we have used the fact that T commutes with TZ because they operate on different 
qubits, and that TZ corrects and detects errors. In the last equality we used the fact that To^^ |Ae)(j4e| = c 
does not depend on |a), \a'). Choosing \a) = |a'), Tv{TZ o £ o |a)(a|) = Tr(c|Q;)(a|) — c, but on the other 
hand 7?. o £ is trace preserving so c = 1 . D 

3.3. Calderbank-Shor-Steane Codes. We give here the definition of CSS codes, which is slightly 
modified from the definition in [|l3| . A linear code of length m and dimension A; is a subspace of dimension 
k in F™, where F™ is the m dimensional vector space over the field of F2 of two elements. Let Ci, C2 be 
linear code such that {0} C C2 C Ci C F™, and let us define a quantum code by taking the superpositions 
of all words in a cosct of C2 in Ci to be one basis word in the code. We have: 



(3.9) Va e C^/C2 : \Sa) - ,— — - }_^\w + a). 

Note that \Sa) is well defined and does not depend on the representative of the coset since if (al — a2) G C2 
then \Sai) = \Sa2)- Also, for different cosets the vectors are orthogonal, because if (al — a2) ^ C2, then 
{Sai\Sa2) — 0. Thus, this defines a basis for a subspace of dimension 2'^"™(*^i)~'''™(*^2)^ which is our quantum 
code. Note that the support of \Sa) are words in the code Ci. We will see that bit flips can be corrected 
using classical error correction techniques for the code Ci. Before we discuss how to correct phase flips, let 
us define a very important quantum gate on one qubit, called the Hadamard gate, or the Fourier transform 
over F2: 

(3.10) H = H-^ = 

Observe that 

(3.11) H(j,H-^ = CT, 

meaning that a phase flip transforms to a bit flip in the Fourier transform basis. Applying the Hadamard 
gate on each qubit in \Sa)^ we get the state: 

(3.12) \C^)=H®H®---®H\Sa)^^=^== ^ E (-l)^"'+°^-» - ,, ]. ,^ , E(-ir» 
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which is a superposition of words in C^, and so to correct phase flips, one transforms to the Fourier basis 
and corrects bit flips in the code C^. These ideas lead to the foflowing theorem by Calderbank and Shorpsl. 
We give here a simple proof of this theorem, based on theorem |lj. 

Theorem 2. Let Ci and C^ be linear codes over F2, of length m, such that C C2 C Ci C F™, 
and such that C^,Ci can correct t errors. Then the suhspace spanned by \Sa) for all a G C1/C2 is a 
^2d,im{ci)~dim{C2) ^^ qudifitum code which can correct t errors. The error correction procedure, TZ, is con- 
structed by correcting pit flips with respect to Ci in the S-basis, rotating to the C-basis by applying Fourier 
transform bit-wise, correcting with respect to C^ and rotating back to the S-basis. 

Proof: We deflne the procedure TZci to be a unitary embedding of m qubits to 2m qubits, by 

(3.13) 7^cJ^) = k) <» |e) 

for each i e F™, where w e Ci is a string of minimal distance to i, and e e {0, 1}™ satisfies w -\- e — i. 
Since this is a one to one transformation, it is a unitary embedding, and is a possible quantum operator. 
Let efc S {0, 1}™ have at most t I's. Let £1, be an error operator which is a tensor product of bit flips (cr^;) 
where ei, is one and identity on the other coordinates. Then for any \a), \a') supported on C'l we have 

(3.14) Re, o £, o \a){a'\ = \a){a'\ <» |efc)(efc| 
TZ(j± is defined similarly: 

(3.15) TZc^^\j)^\w)^\e) 

where w E C^ is a string of minimal distance to j, and e £ {0, 1}™ satisfies w -\- e — j. Let e/ G {0, 1}™ 
have at most t I's (e/ for phase flips.). Let £f be an error operator which is a tensor product of phase flips 
((Tz) where e/ is one and identity on the other coordinates. Then for any \(3), \f3') supported on C^ we have 

(3.16) i?c- ° Sf ° mW'l = \P){(3'\ ® |e/)(e/| 

Denote by H the operator of applying H on every qubit: 'H = H®H®---®H. We claim that the operator 

(3.17) n = Tfo%ononc'±ononc, 

is the desired error correcting procedures. Tf, Ti are the operators discarding the qubits added for TZ(j± , TZci j 
respectively. 

By theorem w, it is enough to show that this procedure corrects and detects d basic errors. To show 
that it corrects d basic errors, write the error vector e in two parts, ef, and e/ as follows: e^ will be 1 in 
the coordinates where a^ or ay occurred, and elsewhere, e/ will be 1 in the coordinates where CTz or 
ay occurred, and elsewhere. We can therefore write the error operator £ as a product of two operators, 



£ = £b£f. Now, using, in the following order, equation 3.17, the fact that TZci commutes with £f, equation 



3.14,3.11 and 3.16, wc have the desired result: 



(3.18) TZo£o \a){a'\ ^TfoTboHoTZc± oHo £f oTZc\ o £^0 \a){a'\ 
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TfoTboHo nc± oHoSfO \a){a'\ (g) |eh)(e,,| = 
Tf oJio TZ(j± o Ti. o Sf o \a) (a' \ = 
TfoHo Uc^ o{no£fon)o{no \a){a'\) = 
rfono{Ho\a){a'\)®\ef){ef\ = \a){a'\. 

It is left to show that TZ also detects d basic errors. This follows from the fact that if e 7^ e', then either 
Ef 7^ e'f or efc 7^ e'^^. Now reducing two orthogonal vectors gives zero, i.e. if e^ 7^ ej, 7(, o |efc)(ej,| — and if 
e}^e'fTfo\ef){e'j\^Q. □. 

3.4. CSS codes over Fp. The theory of quantum error corrections can be generalized to quantum 
computers which are composed of quantum particles of p > 2 states, called qupits. To generalize the notion 
of bit flips and phase flips to qupits define the following two matrices: 

• B : B\a) = |(a + l)modp) 

• P : P\a) ^w°'\a) 

27ri .... . . 9 . 

where w = e p . We will consider combinations of powers of these matrices, i.e. the p matrices, 
(3.19) BT"', yc,c'eFp. 



This set can be easily seen to be an orthonormal basis for the set oi p x p complex matrices, with the inner 
product {U,V) = Hr{UB^). Like in the case of qubits, en 
vice versa, via a Fourier transform, which is defined to be 



product {U, V) = -tr{UB^). Like in the case of qubits, errors of type B transform to errors of type P and 



(3.20) W:\a)^^J2'''"'\b)- 

And it can be easily checked that 

(3.21) Vc e Fp, WP^W'^ = B" , WB''W~^P'' 

We can therefore define CSS codes over Fp . The statements and proofs of theorems |l| and || are generalized 
to Fp using the above definition of bit fiips and phase fiips, where F™ is replaced by F™ and Hadamard 
gate is replaced by the Fourier transform W over Fp everywhere. 

3.5. Polynomial Quantum Codes. We define polynomial codes over Fp. Set d to be the degree of 
the polynomials we are going to use, and set m to be the length of the code, p > m will be the number of 
elements in the field Fp we will be working with. Set ai, ...am to be m distinct non zero elements of the field 
Fp. Define the linear codes: 

(3.22) Ci = {(/(ai) • f{a„,))\fix) e F{x), deg{f{x)) < d} C F™ 

C2 - {(/(ai) • fiaraWix) e F{x),deg{f{x)) < d,/(0) = 0} C Ci 

We can now define the quantum code: 

(3.23) VaeCi/Ca, \Sa) = ^ Y. I/K) ' ' ' /K0> 



/el'i,/(0)=a 
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Clearly, C2 has p different cosets in Ci, and so C^ has p disjoint cosets in C^. Thus the dimension of the 
code is p, and the code encodes exactly one qupit. Note that this code is a special case of CSS codes, which 
will be used to prove the following theorem: 

Theorem 3. A polynomial code of degree d with length m over Fp is a [p, m] quantum code which corrects 
min{[22-^J,[|J} errors. 

Proof: Two different words in Ci agree on at most d coordinates, and thus Ci is a linear code of distance 
m — d. It can thus correct and detect [(to — d — 1)/2J errors. C^ is a linear code of minimal distance > d + 1 . 
This is true since the projection on any d coordinates of the code C contains all possible strings of length 
d, and therefore the only vector of length d orthogonal to all the vectors is the vector. Thus, C^ corrects 
and detects [d/2\ errors. Theorem g follows from theorem ||. D 

4. Computing on States Encoded by CSS codes. CSS codes will be used to perform computations 
fault tolerantly: The idea is to compute on quantum states encoded by CSS codes. Each gate is replaced by 
a procedure which imitates the operation of the gate on the encoded states. In order for the computation to 
be fault tolerant, the procedures have to be designed in such a way so that a small number of errors during 
the procedure cannot propagate to too many errors at the end of the procedure, before error correction can 
be applied. The basic definitions are given next. We then show how to perform fault tolerant operations on 
states encoded by CSS codes. We follow Shor's constructions very closely, with some additional tricks and 
modifications mainly in the construction of the ancilla state required for the Toffoli gate, and in the decoding 
and error correction procedures. These modifications are done in order to avoid measurements and classical 
operations during the computation. In fact, this is the only difference between the results presented in this 
section, and the results derived by Shor in []. 

4.1. Fault Tolerant Procedures on Encoded States- General Definitions. Say we have a unitary 
gate g which was applied on the state \a) in the original circuit. We now want to apply a sequence of gates, 
or a "procedure", P{g), on the state encoding \a), such that P{g) will take the encoded \a) to the state 
encoding g\a). 

Definition 12. A sequence of gates P{g) is said to encode a gate g for the code C if for any superposition 
\a), P(.g)|5|„)) = \Sg\o,)). 

We will want P{g) to be such that an error occurring at one gate or qubit during the procedure will not 
affect too many qubits at the end of the procedure, so that the error can be corrected. A location (qi, ..qi, t) 
effects a qubit q' at time t' > t \i there is a path in the circuit from (qi, ..gj, t) to {q\ t'). 

Definition 13. The "spread" of a procedure is the maximal number of qubits in one block in the output 
of the procedure, which are effected by one location in this procedure. 

If we use only procedures with small spread, the error corrections will still be able to correct the damage 
using the undamaged qubits, provided that not too many errors happened during the procedure. 

The notion of reduced density matrices is useful here: At the end of a fault tolerant procedure which 
operates on a state |a), the result will be "correct" on all qubits except those effected by the fault. This 
means that the reduced density matrix on all the qubits except those which where effected, is the same as 
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it would have been if no fault occurred at all. 

4.2. Questions of Ancilla Qubits. In some of the procedures, we will use ancilla qubits, as extra 
working space. At the end of the procedure these qubits will be discarded, in order to get exactly the state 



we need. As was explained in subsection 2.2, we will always discard qubits which are in tensor product with 
the rest of the system, so the operation of discarding means simply erasing their state, and the resulting 
state is a pure state. This is necessary if we want to operate unitary operations on the encoded states. We 
will describe a procedure by specifying what it does to basic states of the code. It is easy to see that if for 
any input basis state, the state of the ancilla qubits at the end of the procedure are in a tensor product with 
the rest of the qubits, and their state does not depend on the input basis state, i.e. 

(4.1) \Sa) — > l^sCa)) ® 1^) 

where A is independent of a, then for any input superposition for the procedure the ancilla qubits will be in 
tensor product with the rest of the qubits, and thus they can be discarded simply by erasing them. 

This requirement of independence of the ancilla qubits on the basis state can be released in two cases. 
An encoding procedure, is the procedure which takes a block of input bits, 0'" to the state encoding 0, 15*0), 
and likewise for 1. For the encoding procedure, we know that the procedure always gets as an input a basis 
state. Thus, we release the above requirement, and demand only that the ancilla state is in a tensor product 
with the computational qubits when the input to the procedure is a basis state. (The ancilla might therefore 
depend on the input, and indeed it will, but we are allowed do discard it anyway.) The requirement of tensor 
product with the ancilla can also be released in the decoding procedure, since the state will not be used any 
more, and we should only check that it gives the correct answer when measured. 

It suffices to check the independence of the ancilla in the case of no fault in the procedure. The fact that 
the procedures are fault tolerant guarantees that even if a fault occurred, the reduced density matrix of the 
non-effected qubits is just like in the case in which no fault occurred at all. 

4.3. Some Restrictions on the CSS Codes. In the following, we will put some restrictions on the 
CSS codes which we will use. This is done in order to be able to apply several gates fault tolerantly bitwise, 
as will be seen shortly. We require that Ci is a punctured doubly even self dual code, and that C2 = C^. A 
punctured code is a code which is obtained by deleting one coordinate from a code C", and a punctured self 
dual code means that we require in addition that C is self dual, i.e. C" — C'^ . We also require that C is a 
doubly even code, i.e. the weight of each word in the code is divisible by 4. To see that C2 = Ci C Ci, as 
in the definitions of CSS codes, observe that if u _L Ci, then wO _L C" so wO € C"-*- = C", so w G Ci. We will 
denote Ci = C, and C2 = C""-. 

We now claim that there are only two coscts of C^ in C. If the length of C is to, then dim{C'^) = 
dim{C') — {rn + l)/2. Hence dim{C) = (m + l)/2 as well, since \C\ — |C"|, because no two words in C are 
mapped to the same word in C by the punctuation. Hence, dimiC^) = m — {ni + l)/2 = (to, — l)/2 and so 
dim{C) — dira{C^) = 1. Observe that C includes the all one vector: 1 £ C. This is true since l™+i g C"^, 
because C" is even, and since C" is self dual, 1™+^ g C". Hence 1™ S C Observe also that the length 
771 must be odd due to the above considerations. This implies that 1 ^ C^. The two code words in our 
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\W) 

wec^ 



quantum code can thus be written as 

(4.2) \S,)= Y. 

wec^ 

I '^'o) J I '^i) I can be thought of as encoding 1 0) , 1 1) respectively. We will make use of the fact that a- b mod 2 — 
ab, for a, 6 e 0, 1, and that a + b ~ a + b. This fact allows us to shift easily between operations on vectors, 
and operations on the bits they represent. We will therefore usually omit the vectors in the notations of \Sq) 
and \Sf), unless there is ambiguity. 

4.4. The Set of Gates for CSS codes. We work with the following set of gates, which we denote by 
Gi: 

1. Not: \a) I — > |l-a), 

2. Controlled not: \a, b) i — > \a, a + b), 

3. Phase rotation: |a) i — >i"-\a), 

4. Controlled Phase rotation: \a)\b) i — > (-l)'»''|a)|&), 

5. Hadamard: \a) ^ ;^ Eb(-l)"'l^>: 

6. Toffoli gate: \a, b, c) i — > \a, b,c + ab), 

7. Swap |a)|6)i — > \b)\a), 

8. Adding a qubit in the state |0), 

9. Discarding a qubit. 

where all the addition and multiplication arc in i^2(i-c. mod 2). We will show later on that this set of 
gates is universal. We remark here, that Qi is by no means a minimal universal set of gates, but the fault 
tolerant procedures become simpler and shorter if we have a larger repertoire of fault tolerant gates that we 
can use. The following theorem shows how to perform gates from Qi on encoded states fault tolerantly. 

Theorem 4. There exists fault tolerant procedures which simulate the operations of all the gates from Qi, 
on states encoded by punctured self dual doubly even CSS codes such that one error in a qubit or a gate effects 
at most four qubits in each block at the end of the procedure. There exist such procedures also for encoding, 
decoding and error correction. Moreover, all these procedures use only gates from Qi, and in particular do 
not use measurements. 

To prove the theorem, we first show this for the gates which can be applied bit-wise, then for the encoding, 
decoding and error correction procedures, and then for the rest of the gates. 

4.5. Bitwise Fault Tolerant Procedures. Let g be a gate on k qubits. A bitwise procedure of this 
gate is defined by labeling the qubits in each one of k blocks from 1 to m, and then applying the gate m 
times, each time on all qubits with the same label. Obviously, an error in this procedure can effect only one 
qubit. All the gates in Gi can be applied bitwise, except the Toffoli gate and the gate which adds a blank 
qubit. These are the NOT, Controlled not. Phase rotation. Controlled Phase rotation, Hadamard, Swap 
and Discarding a qubit. This is trivial for the SWAP gate, and the gate which discards a qubit. Simple 
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calculations show this also for the other gates. In the following we omit overall normalization factors, since 
all vectors are known to be unit vectors. We also set a,b E C jC^ . 

(4.3) \Sa) = ^ |ai +wi) (g)...|am + Wm) I — > ^ |ai + 1 + wi) (g) ...ja™ + 1 + w^) = l^^^j) 

For CNOT, 

(4.4) |5'a)|5'6) = ^ |ai+u;i)®...|a„+w„) ^ |6i + w'^) ® ...|t 



w„ 



y^ |ai + Wi) (g) ...|am + Wm) ^ |ai + 6i + Wi + w'l) (g) ...|am + 6m + Wm + w^) 
= |5'a)|5'a+fc) 

where the last equality follows from the fact that C^ is a linear subspace, and therefore summing over w + w' 
for a fixed w in the code is equivalent to summing over w' . For the Phase gate, apply the gate \a) \ — > i"|a) 
three times on each coordinate. This gives 

(4.5) \Sa)= Y^ |ai+u;i)(g...|a„+w„) ^^ ^ t''^^^°-^+'^^\a^^ w^) ® ...\a^ + w^). 

wec^ wec^ 

This is the desired result, because C is a punctured doubly even self dual code, and it is easy to check that 
all words in C^ have weight which is divisible by 4, and all words in C but not in C^ have weight which is 
3 mod 4. 

For the encoded controlled phase gate, 

(4.6) |^a)|^g)= J2 \S+^)\b + w')^^ J2 {-'^)^"^"'>'^'^"">\a + w)\b + w'} 

w.w' GC-^ w,w' ^C-^ 

Now, {a + w) ■ (b + w') = a ■ b mod 2. This is true since a £ C and w' E C^ so a • w' = mod 2, and 
likewise w ■ b = w ■ w' = Q mod 2. Moreover, a ■ b mod 2 is equal to ab, and so the final state is indeed the 
desired state. Finally, for the Hadamard gate, 

(4.7) 1^,)= Y. \ai+w^)®...\am+wm)^^ ^ ^ (-l)("+«')-|a;) = 

= 5](-i)"-i^)- E E (-ir^''^'"^i^+^) = E(-ir'i'5^)- 

xec bec/c^wec^ b 

4.6. Fault Tolerant Error Correction Procedure for CSS Codes. So far, we have described how 
to apply those procedures which can be obtained by bitwise operations. Before we continue to the Toffoli gate 
and the gate which adds a blank qubit, we first show how to apply encoding, decoding and error correction 
fault tolerantly. These procedures will be used later in the remaining of the gates. 

We now construct the error correction procedure. It is composed from detecting and correcting bit-flips, 
using classical error correction techniques for the code C, rotating by Hadamard gate to the C— basis, and 
correcting bit- flips using again classical error correction techniques. Finally we rotate back by applying 
Hadamard bit-wise. 
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We now describe how to correct bit-flips. For this, we recall that for linear classical codes over F2, 
one can define the parity check matrix H of the code C. The kernel of H is exactly the words in C. If 
an error occurred in a word w, the new word can be written w + e, where e is called the error vector. 
H{w + e) = He = s is called the syndrome of the error, and given the syndrome s, one can find the error 
vector of minimal weight which gives s. The error correction is therefore done by first finding the syndrome, 
and then deducing the error vector from it. 

We now want to compute the j'th bit of the syndrome fault tolerantly. This is simply the inner product 
of the j'th row of H with the word. If out computation was noiseless, we could do the following: we apply 
CNOT from the block we are correcting to one blank qubit, only on the coordinates which are 1 in the j'th 
row of the parity check matrix of the code. This will compute the inner product of the word we are correcting 
with the j'th row of the parity check matrix, and the extra blank qubit will thus contain the j'th bit of the 
syndrome. However, this is not a fault tolerant procedure, since an error in one of the CNOT gates causes 
an error in the extra qubit, which propagates through the other CNOT gates to other qubits in the block. 

To avoid this problem, we will use an ancillary state on / qubits: 

(4-8) -T^ E 1^) 

where / is the number of I's in the in the j'th raw of H, the parity check matrix of C^. This state is actually 
the superposition of all states with an even number of I's. It can be easily constructed by starting with |0'), 
applying Hadamard on the first qubit and then CNOT from this qubit to all the other I — 1 qubits, to get 
the "cat state" on I qubits, 

(4.9) |cai,) = i=(|0') + |l')). 

and then rotating each qubit of the cat state to get the desired state. 

We would now like to apply CNOT bitwise from the block we are initializing to the cat state only on the 
coordinates which are 1 in the j'th row of the parity check matrix. Then we apply a classical computation, 
using only gates from Qi, on the ancilla state, to find out the parity of the strings in the ancilla state, and 
write this parity on another qubit, initialized in the state |0). The resulting state will be the j'th syndrome 
bit. 

The only problem in this scheme is that the generation of the cat state is not done fault tolerantly, 
and thus one error can cause the entire cat state to be ruined; The CNOT gates will then propagate this 
error to many qubits in the block. The solution to this problem is to verify that the cat state is indeed a 
superposition of the two states |0') and |l'), before continuing. The relative phase between the two states 
can still be mistaken, but this will not cause any error to propagate to the state by the CNOT gates, but 
only cause the syndrome to be mistaken. To see this, suppose we have instead of the cat state, the state 
co|0) + ci|l). This state transforms after the Hadamard gates to the state: 

(4.10) coEN)+ciE(-1)"I*) 

i i 
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Now, consider applying CNOT's on all the 1 coordinates in the parity check matrix from a correct encoded 
state to ^j \i). This is simply the identity operator: 

(4.11) (co|5o)+ci|5i))^|z)^(co|5o)+ci|^i))^|*) 

i i 

and the same for the other term X]j(~l)*^K)- This means that in spite of the fact that the cat state is not 
correct, this does not cause any error in the original state. 

This verification was done by Shor|64] using measurements and assuming noiseless classical computation, 
by measuring the XOR of pairs of the qubits. If we want to avoid measurements, we proceed as follows. We 
now want to compute whether the bits in the cat state are all equal. For this, note that checking whether 
two bits are equal, and writing the result on an extra blank qubit, can be easily done by a small circuit 
which uses Toffoli and NOT gates. We denote this circuit by S, and also denote the qubits in the cat state 
by 1, ...I. We add I — 1 extra blank qubits, and apply the circuit 5* first from each even pair of qubits (e.g. 
the pair of qubits (1, 2), (3,4)...), to one of the blank qubits; Then apply S from each odd pair of qubits 
(e.g. the pairs (2, 3), (4, 5)...) to one of the remaining blank qubits. We get I — 1 qubits which are all 1, if no 
error occurred, indicating that all the qubits are equal. We then apply a classical circuit on all these qubits, 
which checks whether they are all 1, and write the result on an extra blank qubit, which is our check bit, and 
indicates that all the bits in the cat state are equal. We now want to use the cat state, but condition all the 
operations on the fact that the check bit is indeed 1. However, if we do this, an error in the check bit, might 
propagate to all qubits in the state we are trying to correct. Hence, to keep the procedure fault tolerant, 
we construct m different check bits, one for each qubit in the state we are correcting. This is done using 
m(l — 1) blank qubits, and applying all the operations above, where each operation is repeated m times, to 
TO different target qubits. Thus, we can verify that the cat state is of the form Co|0) +ci|l), fault tolerantly. 
We can now condition all the operations done in the syndrome measurement involving the i'th qubit, on the 
i'th check bit. 

From the syndrome s we can compute the error vector e which is the vector of minimal weight which 
gives He = s. This can be done by classical operations, and need not be done fault tolerantly. Applying a 
CNOT from the result bit e^ to the i'th bit will correct a bit flip in the i'th bit. Now, we do not correct 
all qubits according to the error vector computed from one copy of the syndrome, since an error during the 
computation of the error vector might result in the entire error vector being mistaken, and the procedure 
will not be fault tolerant. Instead, we compute the syndrome independently m times, and from the i'th copy 
of the syndrome we compute e^, from which we apply a CNOT to the i'th bit of the state which we are 
correcting. The fact that for each bit we compute the syndrome independently ensures us that the procedure 
is fault tolerant. 

To apply error correction, we first apply error corrections of bit flips, according to the code C. We then 
apply a Hadamard gate to transform to the C-basis, and correct bit flips again, according to the code C 
Then, we apply a Hadamard gate again, to get back to the S'-basis. 

In all the procedures we have described so far, one fault causes at most one error in each block. Unfor- 
tunately, the propagation of errors in the error correction procedure is much worth. One fault in one of the 
circuits S, checking whether two qubits in the cat state are the same, might cause four qubits in this cat 
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state to be contaminated, where their check bits might still indicate a green light for following procedures. 
Hence, during the error corrections, each one of the four errors can propagate to the one qubit which is 
conditioned upon it. Apart from this bottle neck, all other errors have exactly one spread. 

4.7. Fault Tolerant Encoding Procedure for CSS codes. An encoding procedure takes 

(4.12) |0">^|0">|5o) 

in^ini5i) 

To construct this procedure fault tolerantly, it is enough to generate a state \So) fault tolerantly. This suffices 
since given a string of bits, lO™) or If"), we first generate |5o) and then apply a controlled not bitwise from 
the given input string to the encoded state l^o). 

To generate the state \Sq), start with m blank qubits, |0™), then apply an error correction procedure 
with respect to a code which consists of one word: |5o) alone. This is done by first applying Hadamard 
gates bitwise on 10™), and then correcting bit flips according to the code C^. To see that we indeed get the 
state l^o), note that after the first rotations we have X]i=o I*)- "^^^ corrections will then take this state to 
a uniform distribution over all the basic states in C^, due to the linearity of the code. 

4.8. Error Correction which Projects any Word into the Code. We would like to insert here 
one important modification, which is not necessary for the fault tolerant error correction, but will become 
crucial when applying the error corrections in the recursive scheme. This is the requirement that the error 
correction takes any word to some word in the code, regardless of the number of faults. Roughly, this is done 
by checking whether too many errors occurred, and if so replacing the entire block by another block which 
is initialized in the state |S'o). However, we should be careful to keep the procedure fault tolerant. We do 
this in the following way: Before starting the correction procedure, we generate another state |5o) on ancilla 
qubits, as in the encoding procedure. When computing from the i'th copy of a syndrome whether the i'th 
qubit is wrong, also compute whether the number of faults according to the syndrome is smaller than d, and 
write the answer on another qubit. The CNOT which checks if the i'th bit is wrong and if so applies NOT 
on the i'th qubit, is replaced by a Toffoli gate which also checks if the number of faults is smaller than d. 
We then swap the i'th qubit with the i'th qubit of the state 15*0), conditioned that the number of faults is 
indeed larger that d. To achieve a swap between the second and third qubit conditioned on the first qubit, 
apply three Toffoli gates one after the other, where the target of the first gate is the third qubit, the target 
of the second gate is the second qubit and the target of the third gate is again the third qubit, i.e. 

(4.13) Controlled{a)SWAP{b, c) = T{a, 5, c)T{a, c, b)T{a, b, c) 

which is easy to check. 

To see that this procedure indeed takes any word to some word in the code, observe that this is true if 
no error occurs in the procedure itself, and since the procedure is fault tolerant, the final state will differ 
from a word in the code only in the qubits effected by an error. 

4.9. A Fault Tolerant Decoding Procedure for CSS codes. A decoding procedure applies 

(4.14) \Sa)^\Aa)\a) 
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where the state \Aa) is an ancillary state which depends on a. (We can discard this state at the end of the 
procedure; we will see that whenever the decoding procedure is applied, the state encodes a well defined 
logical bit a. ) To apply this transformation, we compute a independently m times from the state \Sa)- 
To do this, we add ttP blank qubits, and copy each qubit from \Sa) rn times to m different blank qubits, 
using m CNOT gates. We get m "copies" of \Sa)- (These of course are not really copies of 15*0), since they 
are entangled. However, each word in the classical code is copied m times.) On each copy of the word 
we apply the quantum analog of the classical computation that computes what is the logical bit that the 
word encodes. The answer, which is a if no error occurred, is written on another blank qubit. For this 
computation we use Toffoli, CNOT and NOT gates. We might need some extra blank qubits as working 
space. The computation of a is done is the shortest way possible, regardless of whether it is fault tolerant; 
An error in this computation can effect only the one copy of a which it computes. A fault in the first stage 
of copying the qubits m times can only effect one qubit in each of the copies, and if the number of errors 
in Sa plus number of faults in the first stage is smaller than the number of errors correctable by the code, 
these faults have no effect. One fault in the second stage of the procedure, during the computation of one of 
the a's, can effect only the correctness of that a. 

4.10. Toffoli Gate. To apply the Toffoli gate, we roughly follow Shor's scheme, where we construct 
an ancillary state and use it to obtain the Toffoli gate. The main difference from Shor's scheme is in the 
construction of the ancillary state, which is not completely straightforward if one wants to avoid using 
measurements. The following construction involves many details, and has no underlying structure, as far as 
we can see. As we will see in the next section, the Toffoli gate on polynomial codes can be applied in a much 
easier and shorter way. However, for completeness, we also give the details of the Toffoli procedure in the 
case of CSS codes. 

4.10.1. Construction of the Ancilla state \A). We would now like to show how to construct the 
state 

(4.15) \A) = i|5o5o5o) + l^o^i^o) + |5i5o5o) + \S^S^S{). 

This will be done using the help of the encoded cat states. We will need the definition of the state 

(4.16) \B) = i|5o^o^i) + l^o^i^i) + l^i^o^i) + l^i^i^o). 

which is easily convertible to \A) by applying an encoded NOT on the third block. 
The idea is that 

(4.17) _L(|A) + |B)) 
is actually very easy to construct, because it is equal to 

(4.18) ^('^"> + l^i»(l'5o) + |^i))(|5o) + l^i)) 

which can be constructed easily from 3 block of m blank qubits by applying an encoding procedure and then 
an encoded Hadamard gate on each block. In order to convert this state to |A), we use encoded cat states. 
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An encoded cat state, 

(4.19) \s,at)^^{\sor + \sir) 

is also easy to construct fault tolerantly, in the following way: Generate m \So) states, |S'o)'", fault toler- 
antly, using the encoding procedure on m blocks each containing m blank qubits. Then, apply an encoded 
Hadamard gate on the first block, and then copy this block to all the other blocks by applying encoded 
CNOT from the first block to all other blocks. This results in an encoded cat state. We now apply fault 
tolerant error corrections on each block. 
Now, consider the transformation 

(4.20) \Sor\A} K~. \Sor\A) 

\sir\A) ^ i^i)"i^) 

\sor\B) ^ \sor\B) 

\sir\B) ^ -i5i)'"ii?) 



If we can apply this transformation fault tolerantly, we could start with the state 

(4.21) i(|^„)" + |^^)")(|^) + |B)) 



and apply the transformation 4.20| to get 



(4.22) i(|5o)™ + \S^r)\A) + l{\S„r ISiDlB) 

We might then be able to compute fault tolerantly in which of the cat states ^{\So)"^ ± \Si)"^) the ancilla is, 
and apply a NOT on the third block oi \B), conditioned that the result is the second state ^{\Sq)"^ — 151)™). 
Let us refer to this process as a "measurement" of the cat state, though no measurement will be involved. 



The transformation 4.20 can be done by applying 
(4.23) \Sa)\b)\c)\d) ^ (-l)'^(^^+^)|5,)|6)|c)M) 

on the z'th block in the encoded cat state and the i'th bit in each of the three blocks of |^) + \B). Note 



that transformation 4.23 need not be fault tolerant, and it might ruin the entire block \Sa)- Applying 



transformation 4.23 for 1 < i < ?7i it is easy to check that we get 



(4.24) \Sar\Sb)\Sc)\Sd) ^ {-ir^'''+''^\Say''\Sb)\S,)\Sd) 



which exactly achieves transformation 4.20 



We now run into the problem of how to measure the encoded cat state. To solve this problem, we use 
three encoded cat states, instead of one, and repeat everything that we did on the first encoded cat state 
also for these states. The resulting state is 
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(4.25) lilSor + l^i)™)^!^) + ^(|5o)'" - \S^rf\B) 

Now it becomes possible to measure the triple cat state, using majority. This can be done in several 
ways. One way is to apply encoded Hadamard gates on all blocks of the encoded cat states, which takes the 
encoded states into superpositions of encoded states, with certain parity: 

(4.26) i_(|5o)™ + |5i)™)^-i= J2 l^n)I^.J-l^.™>, 

i=o,i-r=o 

i=0, 1-1 = 1 

To compute the parity fault tolerantly, we compute from each block the bit it represents, decoding it 
fault tolerantly. Then independently compute the parity of the m i'th bits in the m blocks. The parity can 
be computed using Toffoli, CNOT and NOT gates. We now have m parity bits, for each encoded cat state. 
We compare them bitwise by applying on the three i'th parity bits and an ancilla bit a majority vote 

(4.27) \a, b, c, d) i — > \a, b,c,d + maj{a, b, c)) 

which can be constructed from Toffoli, CNOT and NOT gates, since they are universal for classical compu- 
tations. Now, apply CNOT bitwise from the resulting majority votes of the parity bits to the qubits in the 
third block oi \A) . 

It is left to see that one error in this procedure effects only one qubit in \A). We will consider errors 
in different stages of the procedure. The construction of an encodes cat state id fault tolerant since it is 
composed of the fault tolerant encoding procedure, and bitwise CNOT's. The construction of the state 
-7^ (I A) + \B)) is fault tolerant because we only used the fault tolerant encoding procedure and the fault 



tolerant encoded Hadamard gate. A problem arises in transformation 4.20. During this transformation, an 



error can cause the entire block \Sa) to be ruined. Hence, an error during this transformation can cause a 



whole block in one of the cat states in the state (4.25) to be effected, together with one qubit in each one 



of the last 3 blocks. However, one such block can ruin the parity bits of only one encoded cat state, and as 
long as the other two are still fine, the majority vote will still give the correct parity. An error in the parity 
computations or in the majority vote cannot effect more than one qubit in \A), since they are done bitwise. 
This concludes the fault tolerant construction of the state \A). 

Note, that the above procedure is fault tolerant if one error occurred, but if we are unlucky and two 
errors occurred during transformation ( [4.25| ) when applied on two different encoded states, this can effect 
the parity bits of two encoded cat states, and thus the majority vote will fail here. In order to tolerate more 
than one error in a procedure, we will need to use more encoded cat states. Using 2fc + 1 encoded cat states, 
we can still say that one error effects only four qubits in each block, as long as the number of errors is less 
than k. 
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4.10.2. Construction of Toffoli Gate Given \A). The construction of the TofFoh gate given \A) 
follows Shor's scheme almost exactly, with minor changes due to the fact that measurements are replaced by 
CNOT gates to additional blank qubit. Also, classical conditioning on the results of the measurements are 
replaced by classical unitary gates (i.e. permutation matrices) on the computation qubits and extra blank 
qubits. Here is a short description of how this is done: We try to generate the transformation 



(4.28) 



= |5„)I5,)I^. 



For this, we will first generate "half" a Toffoli gate: 



(4.29) 



|5o)|5o)|5o) 
l^o)l^i)l^o) 
|5i)|^o)|^o) 
l^i)|5i)|5o) 



I5„,)|5/,)|5, 



c-\-ab/ 



15'o'S'o'S'o) 

PoS'iS'o) 
jS'iS'oS'o) 
\SiSiSi) 



A Toffoli gate can be generated from transformation (|4.29D in the following way. We start with the three 
blocks on which we want to apply Toffoli, |5'a)|S'f,)|S'c). Then we generate \Sq) on an extra block, using the 



encoding procedure. We then apply transformation ( 4.29 ) on the first two blocks and the newly generated 
\So). Then, we apply an encoded CNOT from our original third block \Sc) to the new block. We finally 
apply an encoded Hadamard on the original third block. This gives the overall transformation: 



(4.30) 



l^o) 


^o) 


So)\ 


l^o) 


^l) 


So)\ 


l^l) 


^o) 


So)\ 


l^l) 


Si) 


So)\ 


l^o) 


So) 


Si)\ 


l^o) 


Si) 


Si)\ 


l^l) 


So) 


Si)\ 


l^l) 


Si) 


Si)\ 



\So) 
\So) 
\So) 
\So) 
\So) 
\So) 
\So) 
\So) 
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1 

1 

1 

1 

1 

1 

1 

V2 



\SoSoSo){\So) + 


Si)) 


\SoSiSo){\So) + 


Si)) 


\SiSoSo){\So) + 


Si)) 


\SiSiSi){\So) + 


Si)) 


\SoSoSi){\So) - 


Si)) 


\SoSiSi){\So) - 


Si)) 


\SiSoSi){\So) - 


Si)) 


\SiSiSo){\So) - 


Si)) 



Note that if the fourth block was not there, we are done, because the operation on the first three blocks 
is exactly Toffoli. We next decode the fourth block, and apply some operations conditioned on the qubits 
containing the results of the decoding. Note that if the decoding is 0, there is no phase to correct, since the 
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gate which has been performed is exactly the Toffoh gate. Hence, we would like to apply the operation 

(4.31) |5a)|5fc)|5,) ^ i-ir''+'\Sa)\Sl,)\S,) 

on the first three blocks, conditioned that the decoded qubits are 1. This can be applied bitwise, in the 
following way. First, apply bitwise a controlled phase shift on \Sc) and the decoded qubits. This will give 
the factor (—1)^. To apply |S'a)|S'6) i — > (— l)"''|S'a)|5h) conditioned on the decoded qubits, apply bitwise the 
operation: |a)|5)|d) i — > (— l)"'"^|a)|5)|d) where \d) is a decoded qubit. This operation can be achieved by 
adding a blank qubit, |a)|6)|0)|(i) applying a Toffoli gate on the first three qubits, followed by a controlled 
shift on the last two qubits, and then by a Toffoli gate again on the first three qubits. 

It is left to show how to construct transformation (4.29|). This is done by generating the ancilla state \A) 



as before, where one of the blocks of \A) is the third block, and apply encoded CNOT from the first block 
of \A) to the first block of \a) and from the second block of \A) to the second block of \a). This achieves the 
transformation: 

(4.32) |5o)|5o)|A) ^^ ^{\S„SoSoSoSo) + \S„SiS„SiSo) + \SiS„SiS„S„) + \S,SiSiSiSi)) 

\S„)\Si)\A) ^^ ^{\S„SoSoS,So) + \S„SiS„SoSo) + \SiS„SiSiSi) + \SiSiSiSf,So)) 
\Si)\S„)\A) ^^ ^{\S„SoSiSoSo) + |5o5i5i5i5i) + \SiS„SoS„S„) + \SiSiS„SiSo)) 

\Si)\Si)\A) ^^ id^oS-o^i^i^i) + \SoSiSiSoSo) + \SiS„SoSiS„) + \SiSiS„S„So)) 

We note that the last three blocks have strong connection to the Toffoli gate. More precisely, we note 
that projecting the above states on the subspace where the first two blocks is |S'o)|S'o), the gate which was 
achieved is exactly the Toffoli gate. The projection on the subspace in which the two blocks are |S'o)|5'i) 
is not a Toffoli gate, but can be converted to a Toffoli gate by applying a NOT on the second block and a 
CNOT from the first block to the second block. Projecting to the other two possible subspaces, we again 
get a Toffoli gate by simple corrections: for 15*1)150) we should apply NOT on first block and CNOT from 
second to third block, while for |5i)|5i) the gate can be corrected to Toffoli by applying a CNOT from the 
second block to the third, then a CNOT from the first to the third and then a NOT on the last black. 

We now have to make these adjustments, conditioned on the state of the first two blocks, without 
measurements. This is done by decoding the first two blocks, and applying the adjustments conditioned on 
the state of the decoded qubits, bitwise, meaning that we apply the following operation on five qubits: 



(4.33) |0, 0) |a, 6, c) i — > |0, 0) |a, 6, c) 

|0,l)|a,6,c) I — > \0,l)NOT{2)CNOT{l,2)\a,b,c) 
|l,0)|a,6,c) I — > \l,0)NOT{l)CNOT{2,3)\a,b,c) 
|l,l)|a,6,c) I — y |l,l)iVOT(3)CiVOr(l,3)CiVOr(2,3)|a,6,c) 

This operation is reversible, and is classical. Therefore it can be constructed out of the classical gates which 
are in the set Qi. It is easy to check that indeed it achieves the correct transformation. 
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5. Computing on States Encoded by Polynomial Codes. In the last section it was shown how to 
implement fault tolerantly the set of gates Qi. It turned out that all the gates were very easy to implement, 
except for the last gate: The Toffoli gate. This turned out to involve many tricks, and seems not to have an 
underlying theoretical structure. In this section we show that when transforming to qupits, and using the 
polynomial codes, one can use the algebraic properties of these codes to implement the gates fault tolerantly 
in a manner which seems logical and easy to explain. Moreover, the procedures are shorter, and require less 
operations. Thus, as we will see later, the threshold which we achieve using polynomial codes is significantly 
better than that achieved using CSS codes. The error correction, decoding and encoding procedures will be 
similar to those used for the CSS codes. 

We define a set of gates G2, which will be shown to be universal for qupits in the next section. We show 
how to apply all gates from Q2 fault tolerantly on states encoded by polynomial codes. It turns out that 
all these procedures can be applied using the same basic underlying idea. This idea is that when applying 
the gates bitwise, we always get the desired result, except for one problem: Instead of getting the final state 
as a superposition of polynomials with degree d, we sometimes end up with the correct logical pit, encoded 
with polynomials with degree 2d instead of d. To get back into the code which uses polynomials of degree 
d, one has to apply degree reduction. We use techniques which were introduced by Ben-Or et al Q for fault 
tolerant classical distributed computation, on a secret which is shared by several parties. In order to be able 
to use these degree reduction techniques, it is required that after the degree has increased to 2d, the state 
is still a polynomial code, so that errors can still be corrected. For this, we will work with codes of length 
771 = Sd + 1. 



5.1. The Set of Gates for Polynomial Codes. We work with the following set of gates, which we 
denote by Q2'- 

1. Generalized NOT: V c e F, |a) 1 — > \a + c), 

2. Generalized CNOT: \a, b) 1 — > |a, a + h), 

3. Swap |a)|6> 1 — > \b)\a), 

4. Multiplication gate: 7^ c e _F: \a) \ — > |ac), 

5. generalized Phase Rotation: \/c E F \a) 1 — » w'^^ja), 

6. generalized Hadamard (Fourier Transform) \a) 1 — > -y= X^beF w'''^^|6), VO < r < p. 

7. generalized Toffoh: \a)\b)\c) 1 — > \a)\b)\c + ab) , 

where all the addition and multiplication are in i^p(i.e. mod p). The fact that this set of gates is universal 
will be shown later, in section g. The following theorem shows how to perform gates from O2 on encoded 
states fault tolerantly. Like Qi, Q2 is by no means a minimal universal set of gates, and in fact we make it 
as large as possible so that the fault tolerant procedures become more efficient. 

Theorem 5. There exists fault tolerant procedures which simulate the operations of all the gates from Q2, 
on states encoded by polynomial codes, such that one error in a qubit or a gate effects only one qubit in each 
block at the end of the procedure. There exist such procedures also for encoding, decoding and error correction. 
Moreover, all these procedures use only gates from Q2, and in particular do not use measurements. 

31 



Proof: It turns out that all the gates can be applied pit-wise, and then applying degree reduction. The 
proof of this theorem, like that of theorem H is done by first showing how to perform the encoded gates 
in the cases in which pit-wise applications of the gate will do (without the need in reducing the degree of 
the polynomials.) Then we show how to apply the encoding, decoding and correction procedures. Finally, 
we show a procedure to reduce the degree of the polynomials, which enables us to construct the Fourier 
transform and the Toffoli gate. Both of these gates can be achieved by applying them pit-wise, and then 
applying degree reductions. 

5.1.1. Pit-wise Fault Tolerant Procedures. Applying a generalized NOT gate on each one of the 
qupits in a block gives an generalized NOT on the entire block, as can be easily checked. Applying a 
generalized CNOT from the i'th qupit in the first block to the z'th of the second block, for all 1 < i < ms, 
gives an encoded generalized CNOT from the first block to the second block. In the same way, applying the 
SWAP gate and the multiplication gate pit-wise, achieves an encoded SWAP and an encoded multiplication 
gate respectively. 

5.1.2. Fault tolerant Procedure of General Phase Rotation. Define c; as the interpolation coef- 
ficients such that 

m 

(5.1) V/eF[x], deg{f)<m-lJ{0) = Y,^^fi^^)■ 

To achieve a rotation by w'^", we apply on the I'th qupit the gate \a) i — > w'''"-\a). This achieves the desired 
operation because: 

(5.2) \Sa}= Y. l/(«l),-,/Kn)) ^ 

fevj(o)=a 

^ n^,z«='/("')|/(ai),...,/(a™))= 
fevi,no)=a 

Y, w^\fia^),...Jiam)) 
/evj(0)=a 

5.1.3. Fault Tolerant Error Correction Procedure. These procedures can be applied exactly as 
was done in the case of the CSS codes, except that everything is replaced by the natural analogue over the 
field Fp. 

For the error correction procedure, we first generate the general cat state, which is a superposition of all 

strings of equal pits: 

p-i 

(5.3) |caif)=5]|a") 

This is done by applying the generalized Fourier transform on a blank qupit, and then copying it using 
generalized CNOT gates to more blank qupits. We now apply a generalized Fourier transform on each of 
the coordinates, to achieve the state 



(5-4) E 



j,j -1—0 7nod p 
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which is simply an equal superposition of all strings j which satisfy ^j, jk — mod p, as a natural gen- 
eralization of the corresponding state for qubits which was the superposition of all states with parity zero. 
The calculations of the syndrome, like in the CSS case, are done by computing the inner product of the 
corresponding rows in the parity check matrix of the code. To compute the inner product for the i'th row of 
the check matrix, hi^i, with a vector ai, we need to sum ^j hijai. We thus add hi^iai to the I'th coordinate 
of the ancillary state. If no error occurred, the inner product is supposed to be zero, so the ancillary state 
does not change, since we have added to the ancilla a vector of which the coordinates sum up to mod p. 
The rest of the error correction transforms smoothly to the case of computing over the field Fp. As a general 
rule, the gates NOT, CNOT and Hadamard are replaced by their generalized version, i.e. generalized NOT, 
generalized CNOT and Fourier Transform over Fp, and this achieves the desired transformation. 

5.2. Fault Tolerant Decoding and Encoding Procedures. The encoding procedure is achieved 
exactly like in the case of CSS codes: We generate \So) by correcting according to the code C2, and then we 
add the input pits pit-wise. The decoding is also done exactly in the same way. 

5.2.1. Fault Tolerant Procedure of the Fourier Transform Gate. The desired transformation 
is: 



(5.5) \s,)^±Y^w'^''\S,). 

To achieve this, first fix ci, ...,€,„ to be the interpolation coefficients, i.e. for any polynomial /(x) over Fp 
with deg{f) < to — 1, the zero coefficient of / satisfies /o = Tlii'^ifi^i)- Denote by wi = w"^',! = l,...,m. 
and recall that in our notation 

(5.6) Wiw,) ■.\a)^^J2 <'l^)- 
We now apply W{wi) to the I'th qupit for all 1 < ? < m. 



(5.7) \Sa) ^-^ Wiwi) ® Wiw2) ® • • • ® WiWm)\Sa). 

The transformation takes us from 15*0) to a state which we denote by \a): 

(5.8) l^-) = 4l E l/(«i),-,/(a™))^ 

bl,b2,..bm£F feVJ(0)=a 



Vp^ 



For each string bi, ...bm G Fp, associate the unique polynomial b(x) which satisfies b(ai) = bi, and has 
degree deg{b) < m — 1. The exponent of w in equation |5.8| can be written in a much simpler form when b{x) 
is of degree deg{b) < m — d — 1. For such b{x), the polynomial h{x) ~ b{x)f{x) is of degree deg{h) < to, — 1 
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so: 



(5.9) Y. eif{ai)b{ai) = ^ eih{ai) = h{Q) = /(0)6(0) 

1=1 i=i 

Hence, the sum over all b with deg{b) < m — d ~ 1 in equation |5.8| gives: 



v/p^+" 



(5.10) -^ Y. E n.'^"''^>l,-bm) 

-1 /ei^,/(o)=a 

^ zi;^(")°|61,..6m) 



bl,b2,..bmeF,deg b{x)<m-d-l feV.J{0)=a 
1 



v/p^^^bi 



b2,..bmeF,deg b{x)<7n-d-l 



-^ y w"''— ^ V |61,..6m) = 

^ fceFp V^ f)l,62,..bmGF,deg 6(3;)<m-d-l,b(n)=fc 

Where |5'^) is the code word of the polynomial code when the degree of the polynomials is at most m — d—1, 
instead of d. 

Now, we claim that the sum over the rest of the b's must vanish. The reason is that the norm of the above 
vector is 1. Now \a) can be written as a sum of two vectors: The contribution from 5's with deg(b) < m—d—1, 
and from the rest of the b's. The two are orthogonal, since different b's are orthogonal. Hence, the squared 
norm of |a), which is 1, (because the operation is unitary and we started with a norm one vector) is the 
sum of the squared norms of the contribution of deg(b) < m ^ d — I, which is also 1, and the norm of the 
orthogonal vector. Thus, the norm of the sum over 6's with deg{b) > m — d — 1 must vanish. 

Now, since m = 3d + I, the degree of the polynomials in |5^) is larger than that of \Sb)- To fix this, 
we apply a degree reduction, which we will show shortly. The degree reduction takes the state |5^) to 
\S'f)\Sb)- To complete the Hadamard transformation, we have to erase \Sl). This is done by applying pit- 
wise subtraction of the second state from the first state. |5'^)|S'f,) will then be taken to |5'q)|S';,). Then, we 
can discard the first register, and this completes the generalized Fourier transform. 

Note that to achieve a generalized Fourier transform with w^ instead of w, we should simply replace w 
by w^ in all places where w appears in the above procedure. 

5.2.2. Fault Tolerant Generalized Toffoli Gate . To apply the generalized Toffoli gate on |S'a)|S'f,)|5c), 

we will again use degree reduction. We first add another state, I^q) which is an encoded using the same 
polynomial code except the degree is 2d. Applying the general Toffoli gate pit-wise on the m coordinates, 
from the first two states \Sa)\Sb) to the extra state gives \Sa)\Sb)\S'^^)\Sc), as is easy to check. We now 
apply degree reduction on the third register, using the fourth register as the target of the interpolation as 
is explained in the next section. This gives \Sa)\Sb)\S'^fj)\Sab+c)- Applying the reverse of the generalized 
Toffoli gate, pit-wise on the first three registers gives \Sa)\Sb)\SQ)\Sab+c), and we can discard the extra \Sq) 
to obtain the desired state \Sa)\Sb)\Sab+c)- 
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5.3. Fault Tolerant Degree Reduction. The term degree reduction means the following. Let C 
and C be two quantum polynomials codes of the same length m, which use polynomials of degree d' and 
d respectively, such that d' > d, where the polynomials are evaluated at the same m points in the field. A 
degree reduction procedure takes a word in the first code |5^) to the word \Sa) in the second code which 
encodes the same logical pit. The restriction on our procedure is that it is fault tolerant. This means that 
we cannot simply decode a and encode it again to get |5'o), because then even one error cannot be corrected, 
since the state of the environment will depend on the encoded pit. 

The following solution, which generalizes classical degree reduction techniques by Ben-Or et a/|9) , is best 
illustrated in the following figure: 



f(al) 


f(a2) 










f(am) 
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target 
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interpolation 



Fig. 5.1. Scheme for degree reduction. 



The idea goes as follows. Let 



(5.11) 



^c,/(a,) = /(0) 



so Cj are the interpolation coefhcients for polynomials of degree less than m. We would have wanted to apply 
interpolation on the coordinates of the encoded state, so as to get a, and then to encode a by the code C. 
However, this is not fault tolerant. The trick is to first encode each coordinate in the original state \S'^, so 
each coordinate is opened to an encoded word in the code C . This is done by first adding m encoded states 
\So), and then, from each coordinate, say the i'th coordinate, apply m generalized CNOT gates to all the 
coordinates in the I'th state 15*0), so that the extra state now encodes the coordinate. This is illustrated in 
the figure by an ?7i x m matrix, the columns of which are the encoded words, each encoding one coordinate 
in the original encoded word. We can now apply interpolation pit-wise from the opened coordinates to an 
extra state 15*0), by computing along the rows of the matrix. If the matrix elements are symbolically denoted 
by flij-, We apply the sum 



(5.12) 



E^. 



jU,ij 



over the elements in the i'th row of the matrix, and write it on the i'th coordinate of the extra state 15*0). 
Note that this computation is done separately on each row, or pit-wise, on the encoded opened words. It is 
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easy to check that if no errors occurred, this indeed achieves the correct state \Sa) on the extra state which 
was the target of the interpolation. However, the state of the ancilla pits certainly depend on the original 
encoded pit. To take care of this, we "wrap" the encoded states by applying the reverse of the operations 
which we applied when we opened the states; To wrap the i'th coordinate, apply m generalized CNOT gates 
to subtract this coordinate from all the coordinates in the i'th opened state. If no error occurred, we get 
back the original m states l^o), which can be discarded. 

We would now like to take care of errors that might occur during this procedure, and this will force us 
to change the above procedure a little, and add error corrections. Note that an error during the opening 
of each coordinate might cause the entire encoded state to be wrong, since this part was not done fault 
tolerantly. Note that the interpolation is completely ruined, if even one of the columns of the matrix encodes 
a wrong pit. Thus, we must apply error corrections before we apply the interpolation. We first apply an 
error correction on each of the encoded states, so that it is a word in the code. Then, we apply an error 
correction according to the code C", encoded by the code C, to the overall word. We will immediately show 
how to do this. Given this transformation, it is easy to see that everything we have done is fault tolerant: 
We first open each coordinate, then apply error corrections, then apply the interpolation, and finally close 
each encoded state back to one coordinate, and discard the ancilla qubits. This achieves the transformation 
of \S'g} to |5^)|5a) fault tolerantly, and completes the description of the degree reduction. 

In the same way, one can achieve the transformation |S'^)|S'(,) to \S'^)\Sa+b) by using the state \Sb) as the 
target of the interpolation, instead of \Sb)- This will be useful in the construction of the Toffoli gate. 

5.4. Fault Tolerant Encoded Error Correction. We show how to apply an encoded error correction 
on a doubly encoded word. This means the following. The state which we operate on is generated by encoding 
a state using the code C, and then encoding the resulting state again, using the code C". We want to apply 
on the entire state an encoded error correction procedure. This means that the procedure is exactly the 
error correction procedure according to the code C, but each gate in the procedure is encoded by the code 
C". We thus want to correct C— encoded pit fiips, which means the operator on words in C" 

(5.13) Ss.ic) ■■ \Sa{C')) ^ \Sa+l{C')) 
and C— encoded phase flips, operating on C" by 

(5.14) £sfiC')--\SaiC'))^W^\SaiC')) 

The natural way to correct these errors on words in the code C encoded by C" is simply to apply the error 
correction procedure of the code C, where each gate is replaced by a fault tolerant procedure according to 
the code C". However, one must be careful, in order not to make a circular argument here. The problem 
is that we want to apply an encoded error correction in spite of the fact that we not yet have the fault 
tolerant procedures for the entire set of gates used in the error correction, and in particular, we cannot 
apply encoded Fourier transform, because in this procedure we use degree reduction, which uses encoded 
error correction. It turns out that this does not pose any difficulty since in this case we can omit the degree 
reduction everywhere. We proceed as follows. 
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For an encoded error correction, we need cat states as in equation 4.9, encoded by the code C". Instead 
of generating cat states of length I as we do in the error correction procedure, we generate an encoded cat 
states on ml qupits. We first generate a state \So{C")) in the polynomials code with degree m — d—1, which 
we denote by C", using an encoding procedure according to this code. We then apply pit-wise generalized 
Fourier transforms, to get 

p-i 



(5.15) ^El^«(^')> 



as is shown in section 5.2.1. We then copy it on Z — 1 ancilla states |S'o(C")) using generalized CNOT gates 



pit-wise. This generates the state 



1 "-' 



(5.16) \S,au) - -= L \S^{C'))\S,{C')) ■ ■ ■ \S.{C')) 

(It might seem as if generating encoded cat states is much simpler than generating regular cat states, as 



we do in section 5.1.3, because we avoid here the main problem: verifying that the cat states are correct 
fault tolerantly. In fact, these verifications are not avoided here, but actually hidden in the generation of 
the encoded states, \S'q) and j^o), which are done using error corrections.) 



From these cat states, it is easy to generate the encoded version of the state 5.4, using generalized Fourier 
transforms pit-wise. We thus have: 



(5.17) J2 \S,AC'))---\S,,iC')) 

j,j- 1—0 Tnod p 

We now want to compute the j'th syndrome pit. Recall that this was done by computing the inner 
product of the string (/(ai).../(am)) with the /th parity check matrix of the code. The un-encoded version 
of this operation is done by adding hjf{aj) to the j'th coordinate in the un-encoded version of the state 
^.17. The natural encoded version of this is done by adding hjUij to the {mi 4- j)'th coordinate in the state 



p. 17 , where a^^ is the i'th coordinate in the state encoding /(ctj). We now apply a classical computation on 
the ancilla state, computing the sum of the encoded coordinates mod p, to give the corresponding syndrome 
bit. In this way we can compute all the pits in the syndrome, where like in the error correction procedure, 
everything is done all over again for each syndrome pit, to avoid propagation of errors. The syndrome is 
computed in this way for each one of the m^ pits, and from the (i, j)'th copy we compute whether the j'th 
encoded coordinate suffered a pit-flip. If so we apply the reverse operation on the (i, j)'th pit. 

A problem arises when we want to transform to the encoded C— basis, since the encoded Fourier transform 



gate is not yet in our repertoire. As was shown in the subsection 5.2.1, applying generalized Fourier transforms 
pit- wise (without degree reduction) takes us to the C — basis of the polynomial code with degree to — d — 1, 
if C" is of degree d. And so after the rotation to the C— basis we should actually correct pit-flips as in the 
first step, except we should replace C everywhere by C". At the end of this correction stage, we apply the 
inverse of the generalized Fourier transforms, pit-wise. 
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To show that this procedure indeed corrects general encoded errors, we first note that it suffices to 
correct encoded pit flips and encoded phase flips, just as in theorem y. The proof of theorem can be 
slightly modified to show that the procedure corrects and detects C— encoded pit flips and C— encoded 
phase flips. Denote by Ti the tensor product of these generalized Fourier transforms applied pit wise. The 
crucial fact is that a C— encoded phase flip transforms by 7i to a C"-encoded pit flip: 

(5.18) Ho £s^^C')\Sa{C')) ^n{-lT\Sa{C')) = {-lT\Ca{C")) ^ £s,iC")\Ca{C")) = £s,ic")on\Sa{C')) 



Hence, the sequence of equalities 3.18 holds also in our case, which shows that the above procedure corrects 



general encoded errors, if their number is smaller than that which the code C can correct. 

6. Universality of the Sets of Gates Qi and C/2.. The sets of gates Qi and Q2 were not chosen 
arbitrarily; They were chosen so that any quantum computation can be expressed using these sets. In other 
words, these are universal sets of gates. A proof of this fact for Qi is missing in Shor's paper introducing 
the set Qi, and we provide here a detailed proof, relying on a universality proof by Kitaev. A similar result 
was achieved independently by Boykin et a/.p^. The proof that the set of gates Q2 is universal is more 
complicated, and is based on geometrical arguments on the groups U{n), together with some basic facts from 
field theory. We start with a discussion of the issue of universality, and then show that our sets of gates Qi 
and G2 are indeed universal. 

6.1. Universal Sets of Gates. We consider a set of gates, and ask which unitary operations can be 
constructed when gates from this set are applied on the qubits, in any order. 

Definition 14. Let p >2. A set of gates Q on k > 1 qupits is said to be universal if G ^ {e^^^^I}reai e 
generates a dense subset in U{p^). 

Note that in quantum computation, one can multiply a gate by an overall scalar of absolute value 1 
(which is sometimes called a phase factor) and the density matrices will remain the same. Therefore we can 
add to Q all phase factors, without changing the set of operations on the quantum states. This definition 
indeed captures the notion of universality because it turns out that an algorithm using any set of gates 
can be translated to an algorithm which uses only gates from a universal set of gates Q, such that a), the 
new circuit computes a function which approximates to any given accuracy the original function (in total 
variation distance) &), the new circuit is only polylogarithmically larger and deeper than the original one, 
and c), the design of the new circuit can be efficiently computed given the design of the original circuit. This 
fact is based on two known results. The first is that a universal set of gates can be used to approximate 
matrices exponentially fast, and the sequence of gates from the universal set can be found efficiently: 

Theorem 6. Kitaev, Solovay,: 

Consider a universal set of gates Q over U{m), for some integer m. Then there exists a polynomial pm 
such that any element of U{m) can be approximated up to e by a word from G which is not longer than 
Pm{log{l/e)), and this word can be found efficiently (in time which is pm{log{l/e))) by a classical Turing 
machine. 

The proof of this theorem|39[ |6(| uses Lie groups and Lie Algebras, and will not be discussed here. The 
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second result which we will need to justify the choice of definition of universality, is that an operation on any 
number of qubits (qupits) can be achieved using gates on two qubits (qupits). This was proved for qubits 
by DiVincenzo(26|, and simplified by Barenco et. al.^. We give here a proof for the general case of qupits. 

Theorem 7. Let Q be a universal set of gates on k > 2 qupits, for p > 2. Consider the Hilbert space of 
m> k qupits. Then the gates in the set Q, extended to m qupits, generate a dense subset ofU{p"^). 

Proof: The proof generalizes ideas which were first used by Deutsch|Q and Barenco et. al^. We define 
a generalized Toffoli gate on m qupits, Tjn{Q), to be a gate which applies Q on the TTi'th qupit conditioned 
that the first m — 1 qupits are in the state p — 1: 



Where the number of vertical wires is m. The conditioned Q can be applied on the /c'th qupit, instead of 
the TTi'th one, in which case we denote Tm,kiQ)- Following Barenco et. al. [|l we show an explicit sequence 
of generahzed Toffoli gates on m — 1 qupits, Tm_i((5)'s, which constructs Tm{Q). Denote V — Qp, so: 



-# 



yp- 



-# 



yt 



V 



The picture should be interpreted as follows. The first wire is actually duplicated to — 2 times. The sign 
© is actually the pit-flip, which adds 1 modulo p to every element in the field (This is a generalization of the 
NOT for F2, and we sometimes call it the generalized NOT) 



(6.1) 



Pit — flip : \a) 1 — > \{a + l)modp) 



The sequence of gates which consists of the second and third gates, i.e. the controlled generalized NOT and 
the controlled y^, is repeated p — 1 times. It is easy to check that the above circuit indeed gives the desired 
controlled Q, by considering what happens to the basis states, in two cases: all first m ~ 2 qupits are equal 
to p — 1, or not. Using the above scheme recursively we can construct a circuit which uses two-qupit gates 
and applies Tm{Q) for any m > 2 and any one-qupit Q. Note that the recursion starts with two-qupit gates, 
which is the reason why we require fc > 2. 

The gate T,„(Q) can be seen as applying a general Q on the subspace spanned by the last p basis vectors, 
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while applying identity on the rest. The next step is to construct a generalization of the above gate, i.e. a gate 
which applies Q € U{p) on the subspace spanned by any p basis vectors |ii), .., \ip), while applying identity 
on the rest of the basis vectors. Denote this matrix by Tm{Q,ii, ■■■,ip)- We first note that Tm{Q) with Q 
being any permutation on the basis vectors of the Hilbert space of one qupit, together with generalized NOT 
gates, generate all permutation matrices on m qupits. Generalized NOT gates are one-qupit gates, so we are 
allowed to use those. It suffices to construct all matrices of the form Ti^-, where |i), \j) are basis vectors for 
which the strings j, j differ in one coordinate. t,;j switches the two basis vectors \i), \j) and Tij\k) = \k) for 
any k ^ i,j. W.l.o.g. let the coordinate on which i,j disagree be the last coordinate, and let this coordinate 
be equal to a in the string i, and to b in the string j. To construct t^j, apply sufficiently many generalized 
NOT gates on all the coordinates except the last coordinate, so that all these coordinates in both strings 
become equal to p — 1. Now, apply Tm{Q) with Q on the last coordinate being the matrix which permutes 
I a) and \b), leaving the rest of the basis vectors untouched. Then reverse all the generalized NOT gates on 
all the coordinates but the last one, which gives r^ j, and therefore all permutations on basis vectors. The 
general Tm{Q, Ji, .■•, ip) for any Q can clearly be achieved by first permuting the basis vectors ii, ..., ip to the 
last p vectors, applying Tm(Q), and then permuting back. 

The last step is to use Tm{Q, ii, ..., ip) to construct a general p™ x p™ unitary matrix U. Let us denote 
the p™ eigenvectors of U by \tpj) with corresponding eigenvalues e*^^ . U is specified by U\ipj) — e'^^lV'j)- 
Define: 

Then U = nj^=j^[/fc. It is left to show how to construct Uk'- We first construct a transformation R which takes 
\ipk) to A|(p— 1)™) where A is a complex number of absolute value 1. We don't care what R does to the rest 
of the vectors. After applying R we apply the generalized Toffoli which takes \{p — 1)™) 1 — > e^^''\{p— 1)™) 
and does nothing on the rest of the basis states. Then we take X\{p — 1)™) to 1-0^) by applying R^^. This 
indeed achieves Uk, as can be easily checked. To construct R, and similarly i?^^, we start with IV'fc), and 
we first make the coefficient in front of |0™) to be zero by a rotation in the plane spanned by |0™) and 
\{p~ 1)™), which is a special case of the T„i{Q,ii, ...,ip) we have dealt with before. Thus, the weight of jO™) 
has been shifted to \{p — l)™)- In this way, the weights in front of all basis vectors, one by one, are shifted 
to \{p — 1)™), and this achieves R. □ 

We proceed to prove a few geometrical lemmas which will be useful in proving universality of the sets 
of gates we use. The first and second lemmas were used by Kitaev|3^ for proving universality of his set of 
gates. We will use these lemmas to prove universality of Gi and G2- It seems that the method which is used 
here to prove universality is quite general. 

Lemma 1. Let n > 3 Let \a) G C". Let H be the subgroup in U{n), which fixes \a), Let V € U{n) be a 
matrix not in H. Then, the subgroup generated by H and V is dense in U{n). 

Proof: We use some ideas which were first used by Deutsch[^. Let G C U{n) be the closed subgroup 
generated by H and V . Let C/ be a n x rt unitary matrix, and denote the n eigenvectors of U by \i]jj) with 
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corresponding eigenvalues e'^^. U is specified by U\ipj) = e^^^\ipj). Define: 

Tlien U = n^^jC/fc- It is tfius enougli to construct Uk- Let jV^fc) = c|a) + d\5). Let I7) be perpendicular to 
both \a) and \5). Such I7) exists because the dimension is at least 3. To construct [/fc, it suffices to rotate 
IV'fc) to /I7), where / is an additional phase factor, apply a matrix which multiplies I7) by e*^'' and does 
nothing to vectors orthogonal to I7), then rotate back /I7) to |V^fc). The middle operation of multiplication 
by the phase e*^*" of I7) is clearly in H . The transformation which takes \'tpk) to /I7) can be approximated 
to any degree of accuracy as follows. 

We first find some improved versions oiV in G. We have V\a) = a\a) +b\(3). By multiplying V on the left 
by a suitable element of H, we can arrange that the resulting element Vi satisfies: Vi \a) = a\a) + b\S) . There 
is a unit vector |?7) which is mapped by Vi onto b\a) — a\5). So Vi\a) is perpendicular to Vi|?7). Hence \r]) is 
perpendicular to \a). So we can find h £ H such that h\S) — \ri). Let V2 = V^i • h. Then V2\a) — a\a) + b\S), 
and V2 maps the space spanned by \a) and \S) onto itself. I7) and V2I7) are perpendicular to both \a) and 
\S). Hence there is a.n hi £ H that fixes both \a) and \S) and that moves V2I7) onto I7). Let V3 — hi ■ V2. 
Then V3 fixes I7) and V^la) = a\a) + b\S). 

We now construct a sequence of elements Wi £ G (by induction on i) such that Wi\tpk) has the form 
ca'la) + di\j). If we can do this, then for i large, ca^ tends to since \a\ < 1. Hence \di\ tends to 1 as i 
goes to 00 and the lemma will be proved. For i = 0, we simply choose Wq G H such that Wo|(5) = I7). Now 
suppose Wi has been chosen to satisfy our inductive hypothesis. Then 

(6.4) V^W.liJk) = ca'+^\a) + bca'\6) + d,\j) 

The vector bca''\S) + di\"f) is clearly perpendicular to \a) and non-zero. Hence we can find h* d H that moves 
this vector to a vector of the form di+i\j). It suffices now to set Wi+i = h*V3Wi. □ 

Lemma 2. Let Ui,U2 be two non-commuting matrices in SU(2), such that their eigenvalues are not 
integer roots of unity. The subgroup generated by Ui, U2 is dense in SU{2). 

Proof: If X is an element of SU{2) not of finite order, then the closed subgroup generated by x is 
connected and of dimension 1. The closed group generated by both Ui, and U2 is thus connected, and is 
non commutative. Any connected non-commutative subgroup of SU(2) is all of SU(2). □ 

Lemma 3. LetA,B be two non orthogonal subspaces of C"' . LetGA, Gb be dense subsets ofU{A),U{B) 
respectively. Then the subgroup generated by Ga U Gb is dense in U{A B). 

Proof: We will first prove the lemma for the case dim{A) = dim{B) = 1, and A ^ B. Let G be the group 
generated by U{A) U U{B). We consider the natural map from U{2) to SU{2), U 1 — > U/y/Det{U), and look 
at the image of G in SU{2) under this map. We can find in U{A) and in U{B) two matrices such that their 
images are of infinite order and do not commute, and by lemma 0, the image of G is dense in SU{2). Hence, 
G contains all matrices in SU{2) multiplied by a certain phase. Now, observe that taking the commutators 
of these matrices erases the phases. Using the fact that the commutator group of SU{2) is SU{2) itself, 
[SU{2),SU{2)] = SU{2), we have that [G,G] C G contains a dense subset of SU{2). Using U{A) we can 
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generate all phase factors, which proves the lemma for the case dim{A) = dim{B) — 1. 

Let us now consider the general case. Let |ai), ...|am) be a basis for A. Let |/3m+i, ■■■■\l3s) be a basis for 
i?, such that each vector in the basis of B is not orthogonal to A. (To construct such a basis, let us start 
with any given basis. At least one basis vector is not orthogonal to A. Adding it to all the vectors in the 
basis which are orthogonal to A gives the desired basis. ) Let Bi be the subspace spanned by |/3i), and 
denote hy Ai — A ® Bi ® B2 ® ■ ■ ■ ® Bi. We will show by induction on i that the group U{Ai-i) is in the 
subgroup generated by U{A) U U{B) and all phase factors on A ffi B. 

For 1 = 0, the claim is trivial. We assume for i — 1, that the group U{Ai^i) is in the subgroup generated 
by U{A) U U{B), and prove for i. If \/3i) e Ai-i, the induction step is proven. Hence, we assume \f3i) ^ Ai-\. 
We have |/3i) e -B, so we have in our repertoire C/(|/3i)). We divide to two cases. If dim{Ai^i) — 1, then 
the induction step follows from the simple case in which dim{A) = dim(B) = 1. If dim{Ai^i) > 2, then 
dim{Ai^i Bi) > 3, and we can use lemma |l|. Let [7^) e Ai be the (non trivial) projection of |/3i) on 
the subspace orthogonal to Ai^i. U{Ai^i) is exactly the subgroup of U{Ai) which fixes [7^). The matrix 
which multiplies \f3i) by a non trivial phase factor, leaving all orthogonal vectors untouched, does not fix 
|7i). Hence lemma n^ can be applied, and we have U{Ai). D 

6.2. Universality of the Set of Gates Qi used for CSS Codes. The set of gates used for CSS 
codes is shown here to be universal. This is done by a reduction to a proof of Kitaev [p9| , who used lemmas 
I and |. 

Theorem 8. Gi together with all phase factors generate a dense subgroup in the group of special unitary 
matrices operating on five qubits, U{2^). 

Proof: The proof is based on a result by Kitaev|^ , which asserts that the following set of gates is universal: 
CP is a two qubit gate which takes |11) 1 — > *|11) and applies identity on the rest, and the Hadamard gate. 
Let us first show how to construct CP from our set of gates: We will denote by Tk a generalized Toffoli on 
k qubits, which applies not on the fc'th bit conditioned that the first fc — 1 bits are 1. We first construct T4, 
using five qubits. This can be done using TgS, as follows: 

(6.5) a,b,c,d,e 1 — > 

a,b,c + ab,d,e 1 — > 

a,b,c + ab, d, e + cd + abd — > 
OjbjCjdje + cd + abd 1 — > 
a, 5, c, d, e + abd 

which is exactly T4 from qubits 1,2,4 to 5. Define X ~ PlT/^PiT/^, where P4 applies the phase flip P on 
the fourth qubit. X takes |1110) 1 — > i|1110), |1111) 1 — > — i|llll) and does nothing to the other basis 
states. X^ is the three qubit gate which gives |111) 1 — > — 1111) and identity on the rest of the basis 
vectors, tensored with identity on the fourth qubit. Now, to construct CP we apply P^T^P^T^ which gives 
|110) I — > J|110), |111) I — » — i|lll) and identity on the rest, and applying X^ we get CP tensor with identity 
on the third qubit. 

The theorem now follows from Kitaev|g^, who used the geometrical lemmas |l| and ^ to show that CP 
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and the Hadamard gate are universal. Here is Kitaev's argument. Denote by 

(6.6) Xi^Hi{CP)iaHi 

X2 = H2{CP)^\H2 

Define Yi — XiX^^ and I2 = X2X^^. Note that Yi,l2 both operate as the identity on the two states 
|00), \ri) = |01> + |10) + |11). Denote by L the subspace orthogonal to |00) and \ri). Then Yi,Y2 E SU{L). 
Y\,Y2 do not commute, and their eigenvalues are |:(1 ± \/l5). Hence, by lemma they generate a dense 
subgroup in SU{L). Now, add to Yi,Y2 also the gate CP itself. This gate fixes |00), but does not stabihze 
the space I77). Thus, in the space L |?7), Yi,Y2 generate a dense subgroup in the subgroup which fixes |?7), 
while CP is not in this subgroup. We can use lemma || to show that Yi,Y2, CP generate a dense subgroup 
in SU{L ® \ri)). Finally, add Hi to the set Yi, Y2, CP. We have seen that Yi, Y2, CP generate a dense set in 
the subgroup that fixes |00), while Hi is not in this subgroup. Hence, Hi,Yi,Y2,CP, (which are all gates 
generated by H and CP), generate a dense subgroup of SU{L(B \r]) © |00)) = 5J7(4). Together with all phase 
factors, we get the unitary group on two qubits. The result follows from theorem |7|. □ 

6.3. Universality of the Set of Gates Q2 for Polynomial Codes. We would now like to show that 
the set of gates for polynomial codes, Q2, is universal. Note that in this case we are working with qupits, i.e 
over the field Fp, so universality is proved for matrices operating on qupits. We will show that G2 together 
with all phase factors generate a dense subgroup in U{p^) (theorem H). We will first prove an analogue of 
the fact that one qubit gates and classical gates are universal for qubits []. 

Lemma 4. The set of gates consisting of all one-qupit gates U{C'^) and all classical two-qupit gates 
generates all unitary matrices on two qupits, U{C^ ). 

Proof: Let G be the closed subgroup in U{Cp ) generated by all one-qupit gates U{CP) on each of the 
2 qupits, and all classical two-qupit gates. We will use the fact that the lemma we are trying to prove is 
already known for the case oi p = 2. Let S be the two dimensional subspace in C spanned by the first 
two basis vectors |0) and |1). Clearly, U{S) is in U{Cp). Let Si be the two dimensional subspace in the 
Hilbert space of the I'th qupit, and let A — Si (E) 82- This subspace is isomorphic to the Hilbert space of 2 
qubits, and by lemma for the case of qubits, we have that U{A) can be generated. In the same way, we 
can define all possible subspaces of the form A: For each qupit, pick two basis vectors out of the p possible 
basis vectors. Let A be the tensor product of the subspaces spanned by these pairs of vectors. There are 

m — y ) subspaces of this form. By the same argument as before, U{A) is in C for any such A. 

We now want to apply lemma 0. First, we claim that the subspaces of the above form can be ordered, 
Ai, ...Am such that 

(6.7) ®t\ M I A, 
as is easy to check. Second, 

(6.8) ®T=i A, = CP" 

Since U{Ai) C G, the proof follows from lemma y. D 
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It is thus enough to prove that all one qupit gates are in our repertoire. Denote by Qg the one qupit 
matrix of the form: 

/ w \ 

1 



(6.9) 



^0 = 



V 1/ 

For < i < p, we can similarly denote by Qi the one qupit diagonal matrix which multiplies |z) by w 
and applies identity of the other basis states. 

Lemma 5. Qi and QJ are in the subgroup generated by Q2 on three qupits. 
Proof: We will generate Qi® I ® I^ which applies the following transformation: 

(6.10) \z)\a)\b) ^ w\z)\a)\b) 

\3)\a)\b)^ \j)\a)\b) j^z 

To achieve this transformation, we view this gate as applying multiplication by w of the second qupit, 
conditioned that the first qupit is i. Recall that in our notation, P was a one qupit gate which applies a 
phase shift, P\a) ~ w"|a), and i? is a one qupit gate which applies a pit shift, B\a) = \a+l). Both B and P 
are in our repertoire. We now claim that the controlled B, which we denote by CB, is also in our repertoire. 
CB is the gate which applies B on the second qupit, conditioned that the first qupit is i, and applies the 
identity on the second qupit if the state of the first qupit is anything but i. We can generate CB (g) /, since 
the generalized Toffoli gate, together with the addition gate, generate all permutations on basis states of 
three qupits. Now consider the commutator 



(6.11) 



p-i -CB-^ PCB. 



This is exactly the gate we want, since if the first qupit is i, the matrix which is applied on the second qupit 
is P^^ ■ B^^ ■ P ■ B = wl. If the first qupit is in a basic state which is not \i), the matrix which is applied 
on the second qupit is simply the identity. □ 

We now consider the two commutator matrices in < ^^2 >: 

(6.12) X, = HQ,H-^QT^ , Y,^HQi^H-^Q, 

where H is the generalized Fourier transform. We also define the two dimentional subspace Si'. 



(6.13) 



Si = span{\i), 



beFpfi^i 



»}■ 



The claim is that Xi and Yi operate as the identity on the orthogonal subspace to Si. 

Lemma 6. Xi and Yi operate as the identity on S:^ . 

Proof: It is easy to write down explicitly the matrix elements of Xi = HQiH~^Q~^ and Yi 
HQT^H-^Q,. 



(6.14) 



{Xi)ab 



(5ah + i(w-l)ii;(''-^)* 
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lib^i 
-1 lib = i 



^ "'"'' \ Sab + ^{w-' - l)u;("-'')> if & = z 

To see that Xi and Yi operate as the identity on the subspace orthogonal to Si, consider the matrices Xi — I 
and Yi — I, which satisfy equation p. 14 where we substruct Sab from each term. It is easy to see that the 
orthogonal vectors to Si are all in the kernel oi Xi — I and Yi — I, since the vectors v orthogonal to 5^ satisfy: 

(6.15) 

and thus 

(6.16) ^(X, 

beFp 

Y, iY^ - I)abVb - ^{W-^ - 1)11-" Y. "&^"'' =^- ° 
beFp 

We now consider the operation of Xi and Yi on the subspace Si. We claim that they generate a dense 
subgroup in the group of 2 x 2 unitary matrices U{2) operating on Si. We will want to use lemma 0, and 
the main effort is to prove that the eigenvalues of Xi and Yi are not integer roots of unity. The proof of 
this fact is based on some basic results regarding cyclotomic fields and Galois fields, which can be found in 
"Introduction to Cyclotomic Fields" by Washington[[73| . 

Lemma 7. For p > 3, the eigenvalues of Xi and Yi confined to Si are not integer roots of unity. 
We now consider the operation of Xi and Yi on the subspace Si , which we span by the orthonornal basis 
vectors \i) and \ai) — -7=f J2beF b^i^^''\^)- -^Y equation 6.14 and a little algebra we get: 





Vi = 


= , 


/ , VbW 
b,b^i 


-''' =0 




I) 


abVb = 


P 


Y^bW- 

b^i 


bi 


I) 


abVb = 


l, - 

= -iw 

p 


I — L^ 


-b 



(6.17) X,\i) ^ (1 + -{w - l))w-^\j) + ^^ ^ [w - l)u;-''-V,) 

P P 



X,\a,) = {^^^^{w - l)w'")\t) + (1 + ^^{w - l))|a,) 



and for Yi we get the transformation: 




-^ + l)w- 




(6.18) Y,\i)^il + -{w-'- 

P 


l))w\i) + ^^ ^{w- 

p 


-''-'\0^^) 


y.k)-(^^^(--^ 


-l))l".) 



p p 

We denote by X'^, Y- the two matrices confined to Si. Observe now that the determinant of X- is 1, because 
IQ.I = w, \H\ = 1 and |X,| = \H\ ■ \Qi\ ■ \H-^\ ■ [Q.^^] = 1, and |X;| = \Xi\ since X, operates as the identity 
on the subspace orthogonal to 5"^. Hence X- and similarly Y^ have determinant 1. The typical polynomial 
for X; is A^ - Tr(X'^)\ + Det{X'^, which amounts to: 

(6.19) /(A) = X-- 2+b-l)(^ + ^-^) ;, + 1 

Yl has exactly the same typical polynomial. We want to show that the roots of this polynomial are not 
integer roots of unity. Let us assume that one of the roots of the above polynomial is a primitive n'th roots 
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of unity, denoted by C„. The other solution is the complex conjugate of C„, and we have 

(6.20) ^±i^i^^^^^^±^=C„ + C- 

We will first prove that n — p. Denote by Q{w), Q(Cn) the Galois extentions of the field of rationals obtained 
by adjoining w, C„, respectively, to the field of rationals Q. Also, denote by Q{w)^ , the maximal real subfield 
of Q(u'), obtained by extending Q hy w + w^^, and similarly denote the maximal real subfield of Q(Cn) by 
QiCn)^- The idea is that by equation |6.20 , Q{Cn)^ = Q{wV 



\+ 



The degree of the extension deg{Q{w) / Q{w)^) is exactly 2, since w is a root of the minimal two degree 
polynomial x^ — [w + w^^)x + l over the field Q{w)^ . Similarly, deg{Q{Cn)/Q{Cn)^) = 2. On the other hand, 
deg{Q{w)IQ) = p - 1 and deg{Q{(n)/Q) = H^), by theorem 2.5 in @. Now, for three fields, Fi,F2,i^3 
such that F3 extends F2 which extends Fi, we have deg{F^/Fi) = deg{F^ / F2)deg{F2 / Fi) . It follows that: 

(6.21) rfe5(Q(u;)+/Q) = ^ , deg{Q{(:^) + / Q) ^ '^ 

But (5(w)+ = Q(Cri)^, which implies that the degrees of extensions are equal, so 0(n) = p — 1. 

Now if p > 3, then w + w^i ^ Q, since deg{Q{w+w~^) / Q) = (p-l)/2 > 1. Since w+w"^ G Q{^w)C^Q{C,n) 
we have that Q ^ Q{w) C\ Q{Cn)- If P and n were relatively prime we would have Q — Q{w) Q{Cn) (by 
proposition 2.4 in ||73|) and so p must devide n, say n = p^m, with m coprime to p. This implies: 



(6.22) (l){n) ^ p^'^^p - l)(j>{m) ^ p - 1. 
This can only be satisfied if n = p. We get: 

^^ „„N 1 + (p — 1)cos(2tt/p) ,, , , ,, 

(6.23) — !^ — '-^ = cos{k * (27r/p)). 

P 

This equation is not satisfied by any integer fc, for p > 3, since the left hand side is a convex combination of 
cos{2tt/p) and 1, and no real part of a p'th root of unity lies between these two points. This shows that the 
eigenvalues of X- and F/ are not integer roots of unity. D 

We can now prove the theorem. 

Theorem 9. Q2 together with all phase factors generate a dense subgroup in U{p'^), for p > 3. 
Proof: Since we are allowed to operate on three qupits, we can generate Qi by lemma |5|. We can thus 
generate Xi and Yi. It is easy to see that if w 7^ ±1, or p ^ 2 the off diagonal terms of X'^Y^ — Y^X'^ are 
not zero, so X'^ and Y- do not commute. We can apply lemma pi, using the fact that the eigenvalues are not 
roots of unity, by lemma 0. We thus have a dense subset of the unitary group on all subspaces Si. We have 
that (BiSi = CP, and Si is not orthogonal to ©'CgSj- Using lemma || and induction on i, we show that we 
can generate a dense subgroup of U{C^), i.e. all operations on one qupit. Note that apart from all one-qupit 
gates, we also have in our repertoire all classical gates on three qupits, and in particular all classical gates 
on two qupits which act trivially on the third qupit. The theorem follows from lemma y, which gurantees 
universality on two qupits, and theorem ^ which shows that these matrices can be used to construct all 
matrices on three qupits, U{p^). □ 
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7. Fault Tolerance for Probabilistic Noise. In this section we show how to use the fault tolerant 
procedures described in the previous sections, in order to achieve robustness against probabilistic noise with 
constant error rate. We use qubits all along, but everything works for qupits in exactly the same way. The 
scheme is not specific for the quantum codes defined earlier but works with any quantum code, as long as 
it is a quantum computation code ( to be defined shortly). We then define the recursive simulation of the 
unreliable circuit, using such codes. To analyze the propagation of errors, we define the notion of sparse 
errors and sparse fault paths. The threshold theorem is proved in two parts. First, we show that sparse 
fault paths are good, meaning that they cause sparse errors. Then we show that non-sparse fault paths are 
rare. We give the exact threshold condition on the error rate, which depends on the size of the fault tolerant 
procedures. 

7.1. Quantum Computation Codes. In order to improve reliability of a quantum circuit, we need 
a quantum code accompanied with a universal set of gates which can be applied fault tolerantly on states 
encoded by C. The code should also be accompanied with fault tolerant decoding, encoding and error 
correction procedures. In the last three sections we have shown that CSS codes accompanied with the set 
of gates Qi, and polynomial codes accompanied with the set of gates ^2, are quantum computation codes. 
However, any quantum computation code can be used in order to improve the reliability of a quantum circuit, 
provided that its procedures satisfy two simple restrictions. 

Definition 15. A quantum code is called a quantum computation code if it is accompanied with a uni- 
versal set of gates G, with fault tolerant procedures, and with fault tolerant encoding, decoding and correction 
procedures. Moreover, we require that (1) all procedures use only gates from G, and (2) The correction 
procedure takes any density matrix to some word in the code. 

The first restriction allows us to use this code recursively. The second restriction is required for a reason 
which will become clear in the proof of lemma H. Note that the procedures for CSS codes and polynomial 
codes satisfy the above restrictions. We define the spread of the computation code. 

Definition 16. Let C he a computation code using the set of gates Q . Consider a fault tolerant procedure 
for a gate in Q preceded by fault tolerant error corrections on each block participating in the procedure. The 
spread of the code is I if one fault which occurs during this sequence of gates, for any gate in Q , effects at 
most I qubits in each block at the end of the procedure. 

We require that the number of errors that the code can correct, d, is larger than the spread I, so that we 
can tolerate at least one error in a procedure preceded by error corrections. 

(7.1) / < d. 

7.2. Recursive Simulations. From now on, fix a quantum computation code C. It encodes one qubit 
on m qubits, it corrects d errors, it is accompanied with a universal set of gates Q, and a set of fault tolerant 
procedures with spread I. We will use m which is constant and does not grow with n. Let Afo be a quantum 
circuit using gates from Q. Then we simulate Mq by a more reliable circuit Mi, as follows. Each qubit is 
replaced by a block of qubits. Each time step in Mq, transforms in Mi to a working period, which consists 
of two stages. In the first stage, an error correction procedure is applied on each block. At the second stage, 
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each gate which operated in the simulated time step in A/p is replaced in Mi by its procedure, operating on 
the corresponding blocks. 

The input of Mi is the input to Mq, where each input bit is duplicated m times. Before any computation 
is done on this input, we apply in Mi a fault tolerant encoding procedure on each block, which takes |0™) 
to |o™)|S'o) and similarly for 1. At the end of the computation we will again use redundancy, for each block, 
we apply a decoding procedure which decodes the state to m copies of the logical bit, and the output of 
Ml is defined as the majority of the bits in each block. Note that redundancy in the input and output is 
unavoidable if we want robustness to noise, because otherwise the probability for the input and output to 
be correct is exponentially small. This is also assumed in the classical scenario p3[. 

The above mapping, denoted by Mi = 0(Afo), is one level of the simulation, (j) is then applied again, on 
Ml, to give M2, and we repeat this r levels to get Mr — <j)^{Mo), an r-simulating circuit of A/q. The number 
of levels r will be 0(polyloglog(V(Mo))), where V{Mo) is the volume of Mq, i.e. the number of locations 
in Mq. The output of Mr is defined by taking recursive majority on the outputs. This means that first we 
take the majority in each block of size m, then we take the majority, of m such majority bits, and so on for 
r levels, to give one output bit. 

The advantage of using recursive simulations, instead of one step of simulation, as in Shor's scheme [|63|, 
is that in each level error corrections to the current level are added. This means that error corrections of 
all scales are applied frequently during the computation procedures, preventing accumulation of errors in all 
levels. This allows robustness against constant error rate, which seems impossible to achieve in one level of 
simulation. 

7.3. Blocks and Rectangles. The recursive simulations induce a definition of s-blocks: Every qubit 
transforms to a block of m qubits in the next level, and this block transforms to m blocks of m qubits and 
so on. One qubit in Mr-s transforms to to" qubits in Mr- This set of qubits in Mr is called an s-block. An 
0-block in Mr is simply a qubit. In the same way, one can define s— working periods. Each time step in A/q 
transforms to w time steps in Afi, and an s— working period is the time interval in Mr which corresponds 
to one time step in Mr~s- 



Recall the definition of a location in a quantum circuit in subsection 2.7. The recursive simulation induces 
a partition of the set of locations in Mr to generalized rectangles. An r— rectangle in Mr is the set of locations 
which originated from one location in Mq. This is best explained by an example: Consider a CNOT gate 
which is applied in Mq at time t on qubits qi,q2- The location {{qi,q2)it) in Mq transforms in Mi to error 
correction procedures on both blocks, followed by the procedure of the CNOT gate. The set of locations in 
these three procedures is the 1-rectangle in Afi which originated from the location {{qi,q2),t) in Mq. More 
generally, an s— rectangle in Mr is the set of points in Mr which originated from one location in Mr-s- Note 
that the partition to s-rectangles is a refinement of the partition to (s + l)-rectangles. An 0-rectangle in Mr 
is just one location. 

7.4. Sparse Errors and Sparse Faults. In a noiseless scenario, the state of Mr at the end of each 
r-working period encodes the state of Mq at the end of the corresponding time step. However, we assume 
that errors occur in Mr and we want to analyze those. In order to analyze the propagation of errors in Mr, 
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we need to distinguish between the actual faults that occur during the computation, and the errors that are 
caused in the state. First, we focus on the errors in the states, and define a distance between encoded states. 
The hierarchy of blocks requires a recursive definition. 

Definition 17. Let B be the set of qubits in n r— blocks. An (r, k)-sparse set of qubits A in B is a set 
of qubits in which for every r— block in B, there are at most k [r — 1) — blocks such that the set A in these 
blocks is not (r — 1, k) sparse. An (0, k)— sparse set of qubits A is an empty set of qubits. 

Two density matrices pi, P2 of the set of qubits B are said to be (r, fc)-deviated if there exists an (r, fc)- 
sparse set of qubits ACS, with Pi\b~a = P2\b-a- The deviation satisfies the triangle inequality since the 
union of two sets which are (r, ^i), (r, /2)-sparse respectively is (r, li + I2) sparse, by induction on r. 

A computation is successful if the error at the end of each r— working period is sparse enough. The 
question is which fault paths keep the errors sparse. We will show in lemma that this is guaranteed if the 
fault path is sparse: 

Definition 18. A set of locations in an r— rectangle is said to be (r, k)-sparse if there are no more than 
k [r — \) — rectangles, in which the set is not (r — 1, k) -sparse. An (0, k) -sparse set in an 0~ rectangles is an 
empty set. A fault path in Mj. is (r, k) -sparse if in each r— rectangle, the set is (r, k) — sparse. 



7.5. The Good Part: Sparse Fault Paths Keep the Error Sparse . We claim that if the fault 
path is sparse enough, then the error corrections keep the deviation small. The number of faults allowed 
in one rectangle is bounded so that when taking into account the spread of the fault, the number of qubits 
effected in each block at the end of one working period is not too big, so that the density matrix can still be 
recovered. 

Lemma 8. Let C be a computation code that corrects d errors, with spread I. Let Mr be the r— simulation 
of Mq by C . Consider a computation subjected to an (r, k)-sparse fault path with kl < d. At the end of each 
r— working period the error is {r,d) -sparse. 

Proof: It is instructive to first prove this lemma for r — 1. This is done by induction on the time t. 
For i = the deviation is zero. Suppose that the density matrix at the end of the i'th working period is 
d-deviated from the correct matrix. If no errors occur during the t'th working period, the error corrections 
would have corrected the state to (j){p{t)), and the procedures would have taken it to the correct state 
(l){p{t+ 1)). However, due to the fact that k errors did occur in each rectangle, we have in each block at most 
kl qubits which are effected by this error, and the deviation is at most kl < d. This proves the theorem for 
r = 1. For general r, we prove two assertions together, using induction on r. The first assertion implies the 
desired result. 

1. Consider n r— blocks, in a density matrix pr which is (r, d)— deviated from <jf[pQ), where po is a 
density matrix of n qubits. At the end of an r— working period which r— simulates the operation g^ 
on po, with an (r, k) sparse set of faults, the density matrix is (r, d) deviated from 4'''igo ° Po)- 

2. Consider n r— blocks, in any density matrix, pr- At the end of an r-working period which r— simulates 
the operation go on po, with an (r, k) sparse set of faults, the density matrix is (r, d) deviated from 
some word (j)^'{ga o po), where po is a density matrix of n qubits. 
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For r = 1 the proof of the first assertion is as before, while the second assertion is true because of a 
similar argument, using the extra requirement that the error correction takes any word to a quantum code. 
Let us now assume both claims for r, and prove each of the claims for r + 1. 

1. We consider an (r + 1)— working period operating on Pr+i, and (r+ 1)— simulating the operation go on 
Pq. Let us assume for a second two wrong assumptions. First, that all the r— rectangles in the (r + 1)— stage 
have (r, k) sparse set of faults. Second, that Pr+i is (r, d) deviated from (/)''(pi), where pi is a density matrix 
which is (1, d)— deviated from 0(po)- We can now use the induction assumptions. 

The (r + 1)— simulation working period consists of two stages, one is the stage which r— simulates the error 
correction procedures in Mi, and the other part r— simulate one working period in Mi which 1— simulates 
the operation of go in Mq. The first part r— simulates a computation in Mi, which, if no errors occur, is 
supposed to take pi to (Jj^pq). We can use the induction assumption on the first assertion, to prove that at 
the end each one of the r-working periods in this (r + l)-working period, the matrix is (r, d) deviated from 
what it is supposed to be. After w applications of this induction assumption, (where w is the number of 
time steps in the error correction procedure) we get that the matrix at the end of the error correction stage 
in the r— working period, is (r, rf) deviated from (ff[4>{p(^)) = (jf^^{pQ). This is true under the two wrong 
assumptions. 

Now, we release the second assumption. We actually start the computation with a matrix which is 
(r + 1, d)— deviated from (/i''+^(/9o). So most of the r— blocks are (r,(i)— deviated from (/)''+ ^(po), except 
maybe d r— blocks in each (r + 1)— block which are problematic. By the induction stage on claim 0, after 
the first r— working period which r-simulates the operation of gi in A/i, the d problematic blocks in each 
(r + 1)— block are (r, d)— deviated from (jf{gi o p'l). So after the first r— working period the density matrix 
is (r, d)— deviated from <jf{gi o pi), where pi is (1, d)— deviated from (j){po). Thus after the first r— working 
period we are in the same situation as if the second assumption holds, and we can proceed with the above 
argument. 

We now consider the computation part of the (r + 1)— working period. Still under the first wrong 
assumption, using the induction assumption on the first claim, we have that at the end of the (r + 1)— working 
period, the state is (r, d)— deviated from 0^^^(go ° Po)- Thus under the first wrong assumption, the final 
density matrix is (r, d)— deviated from (j)'~^^{g ° Po)- 

We now relax the first wrong assumption, and take into account the fact that there where k r— rectangles 
in each (r + l)-rectangle where the faults where not (r, fc)— sparse. By the fact that the (r + 1)— working 
period r— simulates a sequence of gates with spread I, these errors can effect only kl < d r— blocks in each 
(r + 1)— block, at the end of the (r + 1)— stage, so we have that the final density matrix at the end of the 
(r + 1)— stage is (r + 1, d)— deviated from the correct one, cjf'^^lpo). 



2. We consider one stage of (r + 1)— corrections on the n (r + 1)— blocks in an arbitrary density matrix. 
Again, let us assume that the faults in all the r— rectangles are (r. A:)— sparse. By the induction stage 
on claim g, after one r— working period, the density matrix is (r, d)— deviated from some (f>^{pi). Let us 
consider the trajectory of (f>''{pi) in the correction part of the working period. It is an r— simulation of an 
error correction procedure, which performs the computation which takes the density matrix pi to some word 
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(t>{po). As before, we can prove by induction on the w r— stages that at the end of the correction part of the 
(r + l)-working period, which is an r— simulation of the above error correction, we end up with a matrix 
which is (r, d)— deviated from (jf {(J}{pq)) . Taking into account the r— rectangles with faults which are not 
(r, fc)— sparse, we end up with a density matrix which is (r + 1, d)— deviated from 0^+^(po)- 1^ 

Sparse errors are indeed "good" , because if the error is sparse at the end of the computation, the majority 
of the bits will give the correct answer. 

Lemma 9. Let 2d + 1 < m. If the final density matrix of Mj. is (r, d)— deviated from the correct one, 
then the distribution on the strings which are obtained when taking recursive majority on each r— block of its 
output is correct. 

Proof: Let po be the correct final density matrix of Mq, Let pr be the correct final density matrix 
of Mr, and let p'^ be the final density matrix which is (r, d)— deviated from pr- First, we note that if we 
discard all the r— blocks of qubits which arc not measured for output, the resulting two density matrices are 
still (r, d)— deviated. This remains true if we apply a measurement of all the qubits. Moreover, the output 
distribution remains the same after the measurements. We can thus assume that pr and p'^, are density 
matrices of the output qubits, which are mixtures of basic states, and pj, is (r, rf)— deviated from pr- Pr can 
thus be written as {pi, \cti)}, where \ai) — \i™ z™ ...z™ ). All pits in an r— block are equal, since the matrix 
is correct. The probability that the recursive majority string is i is exactly pi. pj, can be written as {qj, \f3j)}, 
where \(3j) are basis vectors. Let A be subset of qubits such that p^U — Pr\A and A contains all the qubits 
on which pr operates on, except an (r, d)— sparse set. Note, that pj, is supported only on \Pj)} in which all 
the pits in A agree, and that 

(7.2) Yl *=P^• 

j,ftU=a»U 

because the reduced density matrix on A is the same as that of p^. The probability that the recursive 
majority string is / is exactly the sum of probabilities of Pj which give the string I, but the only /3j that 
appear in the mixture agree on A, and we already know that the sum of the probabilities of those is correct. 

a 

7.6. The Bad Part: Non-Sparse Fault Paths are Rare Below the Threshold. Let us first find 
the effective error rate in Mi. It is the probability for one rectangle to have more faults than the code can 
handle. If this effective error rate is smaller than the actual error rate ?], this achieves an improvement in 
reliability from Mq to Mi, and in fact from Ms to Mg+i. Let the code C correct d errors, and have spread 
I. Let A be the maximal number of locations in a rectangle. We require that the probability for more than 
ld/l\ — k faults in A locations is smaller than 77. This is indeed the case if the following condition is satisfied. 

Definition 19. The threshold condition: 
(7.3) 

We can thus define the threshold of a code: 
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Definition 20. Let C be a quantum computation code, which corrects d errors, has spread I, and where 
A is the maximal number of locations in a rectangle for simulations using this code. Let k = [d/l\ . The 
threshold for probabilistic noise for the code C is 

(7.4) Vc{C) 




It is easy to see that any rj < rjc satisfies the threshold condition. The threshold can be computed given the 
parameters of the code. However, it is quite complicated to calculate the parameter A exactly. Moreover, 
in our constructions of the procedures we did not attempt to optimize their size. In our constructions we 
estimate the threshold to be w 10^^ in both cases of CSS codes and polynomial codes, using codes of length 
m — 7, which can correct one error. This estimation is done assuming that measurements can be applied 
during the computation, classical operations in the procedures are error free, and this allows us to save some 
of the operations in the fault tolerant procedures, which we do not describe here. Optimizations of the 
suggested procedures are certainly required and presumably can reduce this threshold by several orders of 
magnitudes. 

We now show that below the threshold bad fault paths are rare. 

Lemma 10. If rj < rjc, 36 > such that the probability P{r), for the faults in an r— rectangle to be (r, k) 
sparse is larger than 1 — rj^^+°> . 

Proof: Let (5 be as follows. 

,r.) (.':)"'"<"'*' 

Such (5 exists for 77 below the threshold. The proof will follow by induction on r. The probability for an 
0— rectangle, i.e. one location, to have faults which are (0, fc) sparse, i.e. that in this location a fault did 
not occur, is 1 — 77. Assume for r, and let us prove for r + 1. For the faults in an (r + l)-rectangle not to 
be (r + l,fc) sparse, there must be at least fc + 1 r— rectangles in which the fault is not (r, fc) sparse. So 

Pir + 1) > 1 — (1 ^ P(r)Y^^ > 1 — 7y(i+'^)'^ , using the induction assumption, and the fact that 

\k^\} 

ifjX+^y < Y\^^ so it satisfies the threshold condition. D 
We can now prove the threshold theorem. 
Theorem 10. The Threshold Theorem for Probabilistic Noise: 

Let e > 0. Let C be a computation code with gates Q . There exists a threshold rjc > 0, and constants 
Ci, C2, C3 such that the following holds. Let Q be a quantum circuit, with n input qubits (qupits), which operates 
t time steps, uses s gates from Q , and has v locations. There exists a quantum circuit Q' which operates on 
nlog'^^(-) qubits (qupits), for time ilog'^^(-), and uses slog'^^(-) gates from Q such that in the presence of 
probabilistic noise with error rate rj < rjc, Q' computes a function which is e-close to that computed by Q. 

Proof: Q will be taken as Mq, and we generate Mr according to the above scheme, where r is chosen so 
that vTj^^'^^^ < e. By lemma |l^, we have that the probability for a fault path to be bad is smaller than e. 
By lemmas ^ and ^ the sparse fault paths give correct outputs. □ 
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8. The Threshold Result for General Noise. We generalize the result to general local noise. The 
threshold condition is slightly different. Again, we fix a computation code and a set of gates G- The proof 
consists of showing that the reliable circuit constructed for the case of probabilistic noise is robust against 
general noise, but the error rates which can be tolerated are slightly worth. Again, the proof consists of 
dealing with bad fault paths and good fault paths separately. The proof that good fault paths are indeed 
good uses a reduction to the case of the probabilistic noise. The proof that the bad part is negligible is more 
involved than in the probabilistic case. 

8.1. Fault Paths in the Case of General Noise. The notion of fault paths is less clear in the case 
of general noise. To define fault paths, write the final density matrix of the noisy circuit as follows: 

(8.1) p{t) = £{t) ■ C{t) ■ £{t ^1)-C{t -!)■■■ £{0) ■ C{0)p{0). 

In the above equation, £{t) is the noise operator operating at time t, and C{t) is the computation operator 



at time t. According to our noise model, equation 2.3, £(t) can be written as a tensor product of operators 



operating on the possible locations of faults at time t, Ai^f Each such operator can be written as a sum of 
two operators, using equation 



2.4: 



^■2) £:A,.W = (i-7?)/ + £;i^^^(t) , \\£'a^^M\<'^^- 



We can replace all the error operators in equation B.l by the products of operators of the form 8.2. We 
get: 

(8.3) p{t) = (® A,, ((1 - V)I + f A,, j) • >C(i) • (® A,,_, ((1 - V)I + f A,,_ j) • >C(i - 1) • • • 

■■■(®A,o((l-»/)/ + fA„,_j)^(0)p(0). 

We can open up the brackets in the above expression. We get a sum of terms, where in each term, for 
each set of qubits Ai^t at time t we either operate {\ — r})I or £^. [t). Thus, each term in the sum corresponds 
to a certain fault path. More precisely, a fault path is a subset of the locations {Aj t}j f , and the term in the 
sum which corresponds to this fault path is exactly the term in which wc apply £'j^. (t) on all locations in 
the fault path, and apply (1 — 77)/ on the rest. As was done in the probabilistic case, we can now divide the 



above sum B.3 to two parts: the sum over the good fault paths, and the sum over the bad fault paths. We 



define the good fault paths to be those which are (r, fc)-sparse, and the bad ones are all the rest. We write: 
(8.4) p{t) = Cg ■ p{0) + U ■ p(0) 

We will treat each part separately. 

8.2. The Bad Part: Non-Sparse Fault Paths are Negligible Below the Threshold. We show 
the trace norm of the had part is negligible, when 77 is below the threshold for general noise. 
Definition 21. The threshold condition for general noise, rj'^ > is defined such that 

.5) el "' I {2f])''+^ < 2ri 




Where as before, d is the number of errors which the code corrects, / is the spread, k = \d/l\ and A is the 
maximal number of locations in a rectangle. We can thus define the threshold of a code, for general noise: 

Definition 22. Let C he a quantum computation code, which corrects d errors, has spread I, and where 
A is the maximal number of locations in a rectangle for simulations using this code. Let k = ld/l\ . The 
threshold for general noise for the code C is 

It is easy to see that any rj < rf^ satisfies the threshold condition. Note that there is a slight difference from 
the threshold in the case of probabilistic noise. A factor of 2 is added to r/, and the factor of e is added to the 
whole definition. These differences are due to slight technical difficulties which rise from the fact that the 
norm of the good operators in not smaller than 1, but can also be slightly larger than 1. 77^ will be smaller 
than the threshold for probabilistic noise, ry^. 

Lemma 11. Let rj <ri'^,e> Q. Let Mq use v locations. Let r ~ polyloglog(-). Then in M^. 

|lA-p(0)||<e , \\Cg ■ pm\ < I + e 

Proof: We shall rewrite the sum over all fault paths, by collecting together all the operations according to 
which r— procedures they were done in. We denote by Cb{i), the sum over all operators on the i'th procedure, 
when applying errors on bad fault paths. £-g{i) will thus be the sum over all operators on the i'th procedure, 
when applying errors on good fault paths. If there are v procedures, we can write: 

(8.7) Pit) = {C,{v) + C,{v)) ■ {Cg{v - 1) + Cbiv -!))■■■ (£,(1) + /:b(l))p(0) 
We first prove that 

(8.8) Vl<*<i; , ||A(z)||<(2r;)(i+^)'^ , ||£^(,)|| < 1 + (2^)(iW 
Where 6 is defined by 

(8.9) M fc + 1 ) (2'?)'+' < (2'7)'+'- 



Such S exists because 77 is below the threshold. The proof of inequality 8.8 for r/ < 77^, follows the lines of 
lemma |l^. We use induction on r, and denote by CHi) the sum over all bad fault paths in an r— procedure. 
For r = 0, a 0-procedure is simply one location, and >C°(J) is the sum over all bad fault paths in this 
procedure. For one location, there is only one term in this sum: the identity, or the gate applied in this 
location, followed by one noise operator. By equation |8.2| , and the properties of the norm on super-operators 
in section 2.8 ||£°(i)|| < 2ry, and ||£"(i)|| < 1 + 2r/ Now assume for r and prove for r + 1. For the faults in 
an (r + l)-rectangle not to be (r + 1, k) sparse, there must be at least k + 1 r— rectangles in which the fault 
is not (r, k) sparse. So by the induction assumption on both Cb{i) and Cg{i) 

(8.10) \\Cl+'m<( ^;^ J((2r;)(i+^r)^+i(l + (2,7)(i+^)^)^-'=-i<e(' ^;^ J((2,7)^^+^^^)'=+^ 
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where we have used the fact (1 + {21])^^+^^'')^^'^^^ < e since (277)(^+'')" < 2r/, and 2r]A < 1. The right hand 
side is < (277)*^^+'')'^ using the fact that (277)*^^+'')'^ < 2?7, and the threshold condition is satisfied for 77 < 77^. 
This proves the induction step for Cb{i). Using ||/3g(i) + 'Cb(i)|| = 1 proves the induction step also for Cg{i). 
To prove the statement, we consider bad fault paths, i.e. at least one r— rectangle is bad. If there are v 
rectangles, we have: 

(8.11) IIAII <v-{l + (277)(i+*)'^)^-i(2r7)(i+^)'' 
taking r = polyloglog(-) we get the desired result. D 

8.3. The Good Part: Sparse Fault Paths Give Almost Correct Outputs. Lemma 12. Let 
V ^ v'cT^ > ^- ^6^ -^^0 use V locations. Let r — polyloglog(^), as in lemma ^R Let Mq output f{i) for a 
given i with probability of error e'. Then for Mr, 

Y.[Cg-piO)],,,<il + e)e' 

bad j 

where bad j's are those basis states with the majority of the result qubits not equal to f(i). 
Proof: For any density matrix p which is (r, d)— deviated from the correct final density matrix of Mr we 
have X^fcad i Pi-i ~ ^- ^^ ^^^^ write Cg as a linear sum (not necessarily positive) of sparse physical fault 
paths, for which lemma || can be applied. We will get the desired result from linearity. We write 

(8.12) £,.p(0) = ^£B-p(0) 

E 

where E runs over all general sparse fault paths, and Ce is the operator corresponding to the computation 
done in the presence of the general fault path E. Now each general fault in i? is a linear sum of physical 
operators: 

(8.13) £'^^^^=£A,^,^a-v)L 



Inserting this to equation B.12 , and we get a linear sum over terms which correspond to physical fault paths, 
with sparse faults. 

(8.14) £g.p(0) = ^A//:/.p(0) 

/ 

Lemma H applies to each term in the sum. We get that each density matrix Ce ■ p(0) is (r, d)— deviated from 
correct. This means that 

(8.15) Yl [^9 ■ /'WIm = E ^/ E [^/ ■ /^(O)]^* = (E ^f-y = T'-(^9 ■ P(0))e' < \\Cg\\e < (1 + e)e' , 

bad i / bad i f 

using lemma |llj in the last inequality. □ 

8.4. The Threshold Theorem for General Noise. We can now prove the threshold result for 
general noise: 
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Theorem 11. The Threshold Theorem for General Noise: 

Let e > 0. Let C be a computation code with gates Q. There exists a threshold rj'^ > 0, and constants 
Ci,C2,C3 such that the following holds. Let Q he a quantum circuit, with n input qubits, which operates t 
time steps, uses s gates from Q , and has v locations. There exists a quantum circuit Q' which operates on 
nlog'^i(-) qubits, for time tlog'^^(-), and uses slog'^''(-) gates from Q such that in the presence of general 
noise with error rate rj < rj'^, Q' computes a function which is e-close to that computed by Q. D. 
Proof: Let Q compute / with accuracy e', meaning that for any input i, the output is f{i) with probabihty 
at least 1 — e'. We construct Q' which computes / with accuracy e + e' . Q' will be the r— simulation of 
Q, where r, is chosen such that the requirements of lemma O are satisfied with e" = e/(l + e'). We write 
the probability to measure a bad basis state as the sum of the diagonal elements of the density matrix p{t) 
corresponding to bad states. 



(8.16) 


> : Pit: 

bad i 


And hence 




(8.17) 1 > ; p(t),,, 

bad i 


\< y]\[Ct■p{0)k^ 
bad i 



E -"Wm = E [^^ ■ '^(o)]m + E [^9 • -"(o)]^ 



bad i bad i 

I E[^.-p(0)]mI < \\C,-pm + \J2[C,-piO)U<e" + {l + e")e' 

bad i bad i 

The first inequality follows from the fact that '^- \pi^i\ < \\p\\ for any Hermitian matrix (see [Q. Lemmas |ll| 
and 13 are used to derive the second inequality. Due to the choice of e" This probability is indeed smaller 
than <e + e'. D 

9. Fault Tolerance with Any Universal Set of Gates. So Far, the reliable circuits which we have 
constructed can use only universal set of gates associated with a quantum computation code, such as the 
sets Gi andtJ2. This is an undesirable situation, both theoretically and practically. Theoretically, we would 
like to be able to show that the fault tolerance result is robust, meaning that quantum computation can be 
performed fault tolerantly regardless of the universal set of gates which we use. Practically, it is likely that 
the sets of gates Gi or G2 are difficult to implement in the laboratory, since they contain gates involving 
three qubits, and we would like to be able to use other, perhaps simpler, universal sets of gates. Indeed, in 
this chapter we provide the desired generalization, and show that the threshold result holds for any universal 
set of gates Q. We require, however, that G contains a gate which discards a qubit, and a gate which adds a 
blank qubit to the circuit. 

Let G he a. set of gates of a computation code, G' be a set of gates to be used for computation. After 
constructing the reliable circuit using G, we will approximate each gate by gates from G', such that the sum 
of the errors of each gate is smaller than the allowed error. The threshold is of course worse, and will depend 
on the set of gates G' ■ 

Definition 23. The Threshold condition for General unitary gates. 

Let S{6) be the number of gates required to approximate a gate from G by gates from G' to accuracy 5. 
For any S < rj'^, we define rj" to be 



(9.1) 77" = max 



.5 SiS) 
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rj < rj'^ guarantees that 5((5o)77 + (5o < rj'^, thence the total error of aU gates approximating one gate of the 
computation code wiU not exceed rj'^, so the fault tolerance scheme for general noise will apply. 
Theorem 12. The Threshold Result in Full Generality: 

Let e > 0. Let Q' ,Q" be two universal sets of quantum gates. There exists a threshold ?/" > 0, and 
constants ci, 02,03,04 such that the following holds. Let Q' be a quantum circuit, with n input qubits, which 
operates t time steps, uses s gates from Q' , and has v locations. There exists a quantum circuit Q" which 
operates on cin\og^^{-) qubits, for time C3ilog'^^(-), and uses 04slog'^^(-) gates from Q" such that in the 
presence of general noise with error rate rj < 7y", Q" computes a function which is e-close to that computed 
byQ'. U. 

Proof: We first approximate Q' by a circuit Mq which uses only gates from the a set of gates Q oi a. 
computation code. Due to the Kitacv-Solovay theorem, this approximation can be done, with polylogarithmic 
cost of space and time, to an arbitrary accuracy. We will require that each gate is approximated up to l/T, 
so that Afo computes a function which is e/2 close to that computed by Q' . We then construct Af,-, the 
r— simulation of Mq, which again uses gates from Q. r is chosen such that the general threshold scheme will 
give an e/2 error when the error rate in is taken to be rj^ = S{So)ri + Sq. To construct Q" , we replace each 
gate in Mr by S{So) gates from Q" , up to So- □ 

10. Robustness Against Exponentially Decaying Correlations. We would now like to show how 
the above results hold also in the case of exponentially decaying correlations between the noise processes, in 



both space and time, as is described in subsection 2.1C. We observe that all the lemmas which we use to 



prove the threshold theorems hold in this case, except for one step which fails. It is the step that shows that 
bad fault paths are rare, in the case of probabilistic noise (lemma |^. The proof of this lemma rely on the 
independence of faults. We observe that the proof of lemma M is actually a union bounds. In this section 



we show that the same threshold as is used for probabilistic noise, (definition 7A) guarantees that the bad 
fault paths are negligible also is the presence of exponentially decaying correlations, for probabilistic noise. 
We use a union bound argument, as follows. Consider fault paths in v r— rectangles. If a fault path 
is bad, there must be at least one r— rectangle in which it is bad. In this rectangle, let us first count the 
number of minimal bad fault paths. If F^ is this number, we have: 

(10.1) Fi < 

and 



(10.2) 

We can solve the recursion, to get 





(10.3) Fr < 




(k+iy-i 



A minimal bad fault path contains exactly (fc+ 1)'' locations. Now, v r-rectangles contain vA^ locations. 
We can bound the number of bad fault paths in v r-rectangles consisting of (fc + l)*" + i locations by choosing 
one r— rectangle (This gives a factor of v). In this rectangle we pick one of the possible minimal bad fault 
paths (This gives a factor or Fr). We can then choose the rest of the locations arbitrarily. This gives that 
the number of bad fault paths in v r-rectangles consisting of (/c -t- 1)'' -I- « locations is at most: 

(fc + l)'"-! 

' vA'- - [k + 1)" 



(10.4) 




I 



Using the assumption |2.6| on the exponentially decaying probability of a fault path consisting of k loca- 
tions, we have that the overall probability of the bad fault paths is at most: 

(10,5) "* Y.' "ft", ) ( ""'■-<' + "■■ 'jc<»+'i'+-(i-,y-^'-i'+')'-< 



k + i } tt V 



This completes the proof for this model of noise, since the expression above decays exponentially fast to 



zero with r, if 77 is below the threshold for probabilistic noise from definition 7.4 



(10,6, (.+ 1)"'"" 

11. Fault Tolerance in a d-Dimensional Quantum Computer. So far, we allowed a gate to 
operate on any set of qubits, regardless on the actual location of these qubits in space. We call this case the 
no-geometry case. We consider also another case, in which the qubits are located a one array, and the gates 
can be applied only on nearest neighbor qubits. For more dimensions, the gates are restricted to operate on 
qubits which are nearest neighbors and lie in the same line. We show that the threshold result holds in full 
generality for d— dimensional quantum computers, for any d > 1. Note that for the geometry of the circuit 
to be preserved, we require that the number of qubits is preserved throughout the computation. Hence 
discarding and adding qubits are not allowed. However, we still need a gate which allows to put entropy 
out of the system. This will be the RESTART gate, which is constructed by discarding a qubit and then 
adding a blank qubit instead of the discarded qubit. We also need the SWAP gate, which switches between 
two qubit, i.e. it applies the unitary transformation \i)\i) ^^ li)|*)- We thus require that the universal set of 
gates which is used in the final circuit, Q" , contains the SWAP and the RESTART gates. 
Theorem 13. Threshold theorem for d-dlmensional circuits:: 

Let e > 0. Let d > \. Let Q' ,Q" he two universal sets of quantum gates. There exists a threshold 
rj" > 0, and constants Ci, 02,03,04 such that the following holds. Let Q' he a d- dimensional quantum circuit, 
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with n input quhits, which operates t time steps, uses s gates from Q' , and has v locations. There exists 
a d- dimensional quantum circuit Q" which operates on Cinlog'^^(-) qubits, for time c-^tlog'^^ {-) , and uses 
C4slog'^^(-) gates from Q" U {S'VKAP} such that in the presence of general noise with error rate rj < 77", Q" 
computes a function which is e-close to that computed by Q' . 

Proof: The only difference from the proof of the threshold theorem for circuits without geometry is that 
the fault tolerant procedures need to apply gates on nearest neighbors only, and that all the qubits remain 
in the circuit throughout the computation. Here is how one level of the simulation is done. We first pick 
a preferred direction, and each qubit will be extended to an array of qubits lying in that direction. The 
simulation will "stretch" the simulated circuit only in the preferred direction, by a constant factor. Let a 
be the maximal number of ancilla qubits used in all the procedures of the computation code Q. Let m be 
the size of the block. A qubit in Qi will be replaced by jn + a qubits, placed in a line along the preferred 
direction. The ancilla qubits will serve as working space, but we will also SWAP qubits with ancilla qubits, 
in order to bring computation qubits closer and operate gates on them. The fault tolerant procedures are 
modified as follows. First, instead of adding ancilla qubits during the procedure, we only use the ancilla 
qubits that are already there, and apply a RESTART gate on an ancilla qubit one step before we use it in 
the procedure. Also, any gate g in the procedure, which operates on qubits which are far apart, is replaced 
by a sequence of SWAP gates which bring the qubits g operates on to nearest neighbor sites, followed by g, 
which is then followed by another sequence of SWAP gates to bring the qubits back to their original sites. 
Since the simulated circuit applies gates on nearest neighbors, say on k qubits in a raw, the number of SWAP 
gates required is at most 2{k + l)m, i.e. a constant. 

The claim is that the procedure is still fault tolerant. This might seem strange since the SWAP gates 
operate on many qubits, and seem to help in propagation of errors. However, note that a SWAP gate which 
operates on a faulty qubit and an unaffected qubit does not propagate the error to the two qubits, but keeps 
it confined to the original qubit, which is now in a new site. Hence, a SWAP gate which is not faulty does 
not cause propagation of error. If an error occurred in a SWAP gate, then the two qubits participating in 
it are contaminated. This will cause contamination of all the qubits on which g operates on, (in the worst 
case), so an error in a SWAP gate is equivalent to an error in all the original sites of the qubits participating 
in the gate, and the final site of the other qubit participating in the SWAP gate. This adds a factor of 2 to 
the original spread of the procedure. All other aspects of the theorem remain the same. □. 

12. Conclusions and Open Problems. The result implies that quantum computation might be 
practical if the noise in the system can be made very small. We hope these results motivate physicists to 
achieve lower error rates, and theoreticians to develop codes with better parameters, in order to push the 
threshold as high as possible. The point at which the physical data meets the theoretical threshold is where 
quantum computation becomes practical. 

We did not attempt to optimize the threshold in the fault tolerant scheme. The reason is that this 
threshold depends on a lot of parameters, such as whether the system is d— dimensional or whether it has 
no geometry; Whether measurements are allowed or not, and which set of gates can be implemented in the 
laboratory. We did give a rough estimate of the threshold in one case, in which the length of the code is 
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m — 7, in both cases of CSS and polynomial codes, in a circuit with no geometry, and with noiseless classical 
operations and measurements allowed. The threshold then is estimated to be « 10^®. This threshold is 
far from being practical, according to the state of the art, and optimization is certainly required. One 
can save space by distinguishing two types of qubits: regular qubits, and "classical" qubits which we do 
not need to protect from phase flips, but only from bit-flips. Such are the qubits involved in the classical 
computation of the error given the syndrome. These qubits can be encoded using classical error corrections. 
In practical cases, it might be possible to allow measurements on such qubits, during the computation, and 
apply noiseless classical computation instead of quantum computation on these qubits, followed by quantum 
gates conditioned on the classical results of these computations. Such ideas might reduce the threshold by 
several orders of magnitude. 

Our scheme requires a poly logarithmic blow-up in the depth of the circuit. It might be possible to use 
a quantum analogue of miflti linear codes|6^, to reduce the multiplicative factor of 0{log{n)) to a factor of 
0{log{log{n)). An open question is whether it is possible to reduce the time cost to a constant, as in the 
classical case. We conjecture that the answer is negative. 

An interesting direction to pursue is to consider different assumptions on the noise, such as very strong 
correlations in time and space between the noise process. Results in this direction were found by Lidar 
Chuang and WhaleyQ. 

The threshold result might have an impact on a long standing question in quantum physics, regarding 
the transition from quantum to classical physics [|7q|. Traditionally, this transition is treated by taking the 
limit of Planck's constant to 0, and it is viewed as a gradual transition (but see pq]). In it was shown 
that for a very high noise rate, the quantum circuit behaves in a classical way. It is interesting to consider 
a different point of view, in which the definition of quantum versus classical behavior is computational. In 
this paper we show that for very small noise rate, quantum systems can maintain their quantum nature. In 
a previous paper, we have shown that quantum systems can be simulated efficiently by a classical Turing 
machine if the noise is large ||]. Suppose that indeed quantum behavior cannot be simulated efficiently by 
classical systems, an idea suggested by Feynmannp7|] which originated quantum computation. In other 
words, suppose BPP ^ BQP. Then, increasing the noise, a transition from the quantum computational 
behavior to classical computational behavior occurs. Does this transition happen at a critical error rate? 
Indications for a positive answer are already shown in a previous paper of ours [^, which might suggest 
that the transition from quantum to classical physics occurs via a phase transition. We view this connection 
between quantum complexity and quantum physics as extremely interesting. 
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